General

  • Target

    JaffaCakes118_a4f8229f67112de642ba3f6b151914c0

  • Size

    389KB

  • Sample

    250108-rz3rkawmhk

  • MD5

    a4f8229f67112de642ba3f6b151914c0

  • SHA1

    857e1f127e7f0935c3507f3f1655426a8ce58366

  • SHA256

    498584bb8da1a6c914fa04842a1f43b0669b6f5290d6a5fc7057d65bf4001785

  • SHA512

    f6570e7b9de8d0b8eb9c4aaaff8cfe9ed46befede9a42addefeb64b1376a9233f956efe0f8dcf58f03eb9b6b8870c2eccb8243b303c11f108c929b5fdfccb2cc

  • SSDEEP

    6144:y//ZuTghDBChyQ33dHFjjStR2E7ATe9SQxed6SXWLLT50SmIxQf21TVw:WhPRQ33dln0R2xaJsddXWLLtPxQu1

Malware Config

Extracted

Family

gcleaner

C2

gcl-gb.biz

45.9.20.13

Targets

    • Target

      JaffaCakes118_a4f8229f67112de642ba3f6b151914c0

    • Size

      389KB

    • MD5

      a4f8229f67112de642ba3f6b151914c0

    • SHA1

      857e1f127e7f0935c3507f3f1655426a8ce58366

    • SHA256

      498584bb8da1a6c914fa04842a1f43b0669b6f5290d6a5fc7057d65bf4001785

    • SHA512

      f6570e7b9de8d0b8eb9c4aaaff8cfe9ed46befede9a42addefeb64b1376a9233f956efe0f8dcf58f03eb9b6b8870c2eccb8243b303c11f108c929b5fdfccb2cc

    • SSDEEP

      6144:y//ZuTghDBChyQ33dHFjjStR2E7ATe9SQxed6SXWLLT50SmIxQf21TVw:WhPRQ33dln0R2xaJsddXWLLtPxQu1

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • Onlylogger family

    • OnlyLogger payload

MITRE ATT&CK Enterprise v15

Tasks