Extracted

• • Target

    FRec28.exe

  • Size

    1.9MB

  • MD5

    4a60ad14e0603b7dd26b2ada6e0a5164

  • SHA1

    d7016a5a7921ef85521567be27970d61da5ab63e

  • SHA256

    520f47496f2050f5784c1fcc9030f99ae6a12738963dfba4475640e550b88dc6

  • SHA512

    b9feeb70b906594c4e603c7352fe21ec010666dc1edfb2b4755056883f9271aac76aeeda735a3370e983e62c7bf777fd014fe6e9b7045f3b22cb57266dcfca75

  • SSDEEP

    49152:XurfurIurKurIurnurlurSGurUyv5X+qSUQiuGogMX8M7Ur:XurfurIurKurIurnurlurZur1xXLJXuK

  Score

  10^/10

  gcleanerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2