Overview

overview

10

Static

static

3

sub_4001ca434aef.dll

windows10-2004-x64

10

sub_4001ca434aef.dll

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    sub_4001ca434aef.bin
  • Size 1.5MB
  • Sample260524-b9frsaew9q
  • SHA256 4001ca434aef1efa8738bcdce056820150a9abc45e8ce3690d9cfc2188e96f0e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cleanuploaderdiscoverytrojan

Malware Config

Extracted

Family

  • cleanuploader

C2

  • https://yourserenahelpcustom.uk/

  • https://retdirectyourman.eu/

  • https://supfoundrysettlers.us/

  • http://149.248.79.62/

  • http://206.166.251.114/

  • http://64.95.10.243/

Attributes
  • c2_uris

    api/connect

    api/session

  • dll_version

    v2.0.1 #File11

Targets

    • Target
      sub_4001ca434aef.bin
    • Size 1.5MB
    • SHA256 4001ca434aef1efa8738bcdce056820150a9abc45e8ce3690d9cfc2188e96f0e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverycleanuploadertrojan

    • Family: CleanUpLoader, Oyster, OysterLoader

      CleanUpLoader aka Oyster is a remote access trojan written in C++, first observed in July 2023.

      trojancleanuploader
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks