Behavioral task
behavioral1
Sample
2004-73-0x0000000000400000-0x00000000013E8000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2004-73-0x0000000000400000-0x00000000013E8000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
2004-73-0x0000000000400000-0x00000000013E8000-memory.dmp
-
Size
15.9MB
-
MD5
90510f215d27f7fac037f62bcadcd920
-
SHA1
a6807e302022f86cdce8c98ec7912d5f8ecbd313
-
SHA256
f3736a4432c735f0772a3c4f512404c57c3afa2c99b1f259f6d219ad07a424ac
-
SHA512
840cf0c271c00ca3bc34c08d42c36e26ac2feb2b737597c605e8d6da4aa7a431c33e44f5052e5cc532c7562a67bbe5b6bee0d6b52006527bf1a4607329c591da
-
SSDEEP
12288:vga47jEnle/EQPlm0Nz70jNS9BQaZgFxLOSfmiJG:Hnlf7iBy4SOb
Malware Config
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
Signatures
-
Gcleaner family
Files
-
2004-73-0x0000000000400000-0x00000000013E8000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ