Overview

overview

10

Static

static

1

86c2f1d69d...5a.exe

windows7-x64

10

86c2f1d69d...5a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1c7f1cd573fa8fef9bc4c87148bae3e8.bin

  • Size

    2.0MB

  • Sample

    230206-j5trvacg27

  • MD5

    03e379d84bd9397b91cb779079c7e267

  • SHA1

    224d6e84e3b123739370bafa50d2814cd600efe3

  • SHA256

    e3275c950bbd37a1c089d7059c01a473c028ec5710e007d5e7d38a5184758070

  • SHA512

    33701256bfb321ed33d383a78a8602fa9da0ca3cafeffb718fac2984357b5691062c85b998a36695f86afd10692bd14d9bf777a42c96e75118b6ccfac3d39745

  • SSDEEP

    49152:v78aAnZ0TFF0+LVE+h7uOtXOhRGhA43fRKCSl5Zo:v7cnZh+LVE+h7uO9OXGTkpl5C

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      86c2f1d69d48924ccb724db2cbf491eb1bbc6ee56793c23152caf7f081a6c25a.exe

    • Size

      2.2MB

    • MD5

      1c7f1cd573fa8fef9bc4c87148bae3e8

    • SHA1

      52b654eccddfe86ef2eb05453d352e6a724c4315

    • SHA256

      86c2f1d69d48924ccb724db2cbf491eb1bbc6ee56793c23152caf7f081a6c25a

    • SHA512

      df3270a48d38f4ac7310e82f311c7257e918dbf8c090d1942d35a62ee75f5c551f7d6d3776ba12e401964510e8ae8a644c1ebc909d7f4369cce7c8055a644356

    • SSDEEP

      49152:d3ZRyzhPy0Kow+MWKuZCpCYKGsGKazjP/snioXRMSLCgv2MR:X6pKFWKpBKG9KaX1/6v2MR

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks