Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1MB

  • Sample

    230125-ndpe9shd9v

  • MD5

    d9c18bdb07613e206c131ff06dc40038

  • SHA1

    f16c63d36f8ea2bd34d1af3c1abd4085faed6953

  • SHA256

    c1e8c6cdf523141ca1c0b147104873a16befbdadde0f94d299c20417882695ef

  • SHA512

    3d83a8dad09d7a9d81180b6b5c4b3305a336db772877986b5eeffd838e813f96e8c362c0db0d85df54266ceded49f537453a13f07c75036ff0d0804ae2f723b5

  • SSDEEP

    49152:Ze5ZB6AcQgnrLQUkMiRpOUlOepkax+vx/9em6LCgv2MR:k5zcPnxk3OUhihvqv2MR

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file.exe

    • Size

      1MB

    • MD5

      d9c18bdb07613e206c131ff06dc40038

    • SHA1

      f16c63d36f8ea2bd34d1af3c1abd4085faed6953

    • SHA256

      c1e8c6cdf523141ca1c0b147104873a16befbdadde0f94d299c20417882695ef

    • SHA512

      3d83a8dad09d7a9d81180b6b5c4b3305a336db772877986b5eeffd838e813f96e8c362c0db0d85df54266ceded49f537453a13f07c75036ff0d0804ae2f723b5

    • SSDEEP

      49152:Ze5ZB6AcQgnrLQUkMiRpOUlOepkax+vx/9em6LCgv2MR:k5zcPnxk3OUhihvqv2MR

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Tasks