gcleaner

General

Target

F5C67FE00B4CBEE07D5E394C87F0C6224BBD841A92151.exe
Size

1.1MB
Sample

230113-x8cvdscc33
MD5

842ae8e819177105e1a1af934b1ee520
SHA1

17104eca148dcd0e15ffb31e4c7a3defdd406d12
SHA256

f5c67fe00b4cbee07d5e394c87f0c6224bbd841a92151d04841f584d56e58b0c
SHA512

b92ecfb5c89996332dd674682694a111aee2bc26b21678c9e60dc592272b91a0f6e9d2a478528b6f257290c5ef43ed9d87d7fac3b8314e768144951333e4916d
SSDEEP

24576:zXdmFGXOGXlTztlj3RbjO7jlUIixAWLc7ARpTLzVONY/tx4:rdfLVTLjxwjlQntT/VO2x4

Score

10^/10

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Extracted

Family

gcleaner

C2

45.139.105.171

85.31.46.167

107.182.129.235

171.22.30.106

Targets

- Target
  
  F5C67FE00B4CBEE07D5E394C87F0C6224BBD841A92151.exe
- Size
  
  1.1MB
- MD5
  
  842ae8e819177105e1a1af934b1ee520
- SHA1
  
  17104eca148dcd0e15ffb31e4c7a3defdd406d12
- SHA256
  
  f5c67fe00b4cbee07d5e394c87f0c6224bbd841a92151d04841f584d56e58b0c
- SHA512
  
  b92ecfb5c89996332dd674682694a111aee2bc26b21678c9e60dc592272b91a0f6e9d2a478528b6f257290c5ef43ed9d87d7fac3b8314e768144951333e4916d
- SSDEEP
  
  24576:zXdmFGXOGXlTztlj3RbjO7jlUIixAWLc7ARpTLzVONY/tx4:rdfLVTLjxwjlQntT/VO2x4
Score

10^/10

evasion spyware stealer trojan gcleaner privateloader smokeloader backdoor discovery loader main themida vmprotect
- Detects Smokeloader packer
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2