Extracted

• • Target

    file

  • Size

    2.1MB

  • MD5

    aaed6d674c4ca6a036f254fdb6b3cd00

  • SHA1

    adce22fdb7816d9b8584d3bcd81a5a920b1b570e

  • SHA256

    bf7150eb92d86841e33dce27c7935a1d1733763d94b5f2425919866c129c1a2b

  • SHA512

    bb3875903354772c8c5e4d52d029b2a1b3e81420fa71b5ee62dd74f534f8f7c64e3b14c4af2526f6d8c5f361b4dd78c0d1a1b5f86740c968d7e01924da814e77

  • SSDEEP

    49152:icPLnQxxlz6G5Z3iDyt4rSue6WUs9iBKBXl84tbLCgv2MR:XPLnQZ6u9FuewtU5l84Vv2MR

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2