Overview

overview

10

Static

static

61328dd0e8...ae.exe

windows7-x64

10

61328dd0e8...ae.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    27b81e73fb6e4bcfa3ce2061918a02d9.bin

  • Size

    1.7MB

  • Sample

    230130-qktdxacc2s

  • MD5

    7cfff59d44ba6ce930297304981928a0

  • SHA1

    00fc767b33373b3b3d369176609a9fafc4aaab43

  • SHA256

    fec11c1d8ced20778350b6a028a47ff40a682f4958326865aaed623aacf437ff

  • SHA512

    ddda3cc3452318137bc9755e5da2e6b3a70aff225ac74aa917607c6f3d238ff6b0d124415dbe3edf9e9b04497d8a32911250527acc31f4d1519d9a6b0a9aea37

  • SSDEEP

    49152:F6/gQvENg0g+hY4owPxmC9M1gYHapQknGW/mzHBGzVx:F6/FaG4jMj1grpQkGWOzH8X

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      61328dd0e8eaad08d83da9c898a3a468157f8a74491417e9fe1ee25ae8fa8fae.exe

    • Size

      1.8MB

    • MD5

      27b81e73fb6e4bcfa3ce2061918a02d9

    • SHA1

      f1aa05a1c1e7c56d1cf7bf6b700e5f0794349704

    • SHA256

      61328dd0e8eaad08d83da9c898a3a468157f8a74491417e9fe1ee25ae8fa8fae

    • SHA512

      86b24ba6c05889b7cba9fe1b7e78cb9a24d1ebe0d6ccd7d79dd868f801df107bbe4507acdf39036bfe9d65a8bd47030e3935f994b98e14cf588aab4b25b5d806

    • SSDEEP

      49152:okug+bbfaiDtiprdGRquNzmANIiGSS66CLCgv2MR:hug+bbfaNprdGRquNzmeItSj6qv2MR

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks