Overview

overview

10

Static

static

52b9337ba1...39.exe

windows7-x64

10

52b9337ba1...39.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    52b9337ba1dafae3708d63d27a06130a6ac408b2f7813f85cd0e058a23c50639

  • Size

    394KB

  • Sample

    230129-wgcvmsga86

  • MD5

    8370d029489615386c340a84fca0731f

  • SHA1

    3b0aaf458164c8c69b3edb42f07c03ff9c74361a

  • SHA256

    52b9337ba1dafae3708d63d27a06130a6ac408b2f7813f85cd0e058a23c50639

  • SHA512

    0e1f418d152973879a313a5eab94085d515e5d3593e4458869c2fcc57ba804963b0130942dde8b4dce389099c3a2b181c8e11ded73ccb1766aa73a45e8a3cc3c

  • SSDEEP

    6144:k9p8syEMT0jvOTIRh2yY2iLvcv66F5QTqhf6sjvik9fhpSZH:kX81FT0jvOeh2y2h6F6ehf/i4u

Score
10/10
gcleaneronlyloggerloader

Malware Config

Extracted

Family

gcleaner

C2

gcleaner.pro

Targets

    • Target

      52b9337ba1dafae3708d63d27a06130a6ac408b2f7813f85cd0e058a23c50639

    • Size

      394KB

    • MD5

      8370d029489615386c340a84fca0731f

    • SHA1

      3b0aaf458164c8c69b3edb42f07c03ff9c74361a

    • SHA256

      52b9337ba1dafae3708d63d27a06130a6ac408b2f7813f85cd0e058a23c50639

    • SHA512

      0e1f418d152973879a313a5eab94085d515e5d3593e4458869c2fcc57ba804963b0130942dde8b4dce389099c3a2b181c8e11ded73ccb1766aa73a45e8a3cc3c

    • SSDEEP

      6144:k9p8syEMT0jvOTIRh2yY2iLvcv66F5QTqhf6sjvik9fhpSZH:kX81FT0jvOeh2y2h6F6ehf/i4u

    Score
    10/10
    gcleaneronlyloggerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • OnlyLogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks