Overview

overview

10

Static

static

1

f29cabdeb6...29.exe

windows7-x64

10

f29cabdeb6...29.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f29cabdeb60bf977229afc0d94ff5d0aac7b4dac23cded74ebd7c6cb4b27c929.zip

  • Size

    2.3MB

  • Sample

    230208-l3eagsac42

  • MD5

    35d451b924b74ac3b984ba5c604ad7f8

  • SHA1

    cabc2bf85d6174f70a0a01ab9deab01f7c0acee8

  • SHA256

    4b56f535164828071de7e88b56b58906ea888af1ac3383b29d260eca850dfbcd

  • SHA512

    1308086692671367e17d573317d27a90e84801e5224aab04cc7ff6d9d6d6c3030b161fdb39a55ea69d9537200e2204242a811645830665ac4ef8fafefc6df49e

  • SSDEEP

    49152:3eTH9eeK41hKHFm8kFg4JlAF6fzm7RezO5YlpKDnPJMv7hcYyYCkrCss2d:ubked1he8lTuF2O5YlpKDnPJKaYskvs2

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      f29cabdeb60bf977229afc0d94ff5d0aac7b4dac23cded74ebd7c6cb4b27c929.exe

    • Size

      2.5MB

    • MD5

      347ac212f3dc0e9b4993abe246959c39

    • SHA1

      464c3bdca5477706ce43c91e2bf41f225bef6992

    • SHA256

      f29cabdeb60bf977229afc0d94ff5d0aac7b4dac23cded74ebd7c6cb4b27c929

    • SHA512

      5c3dce4826de6de644d80fb51e9e20795603f42c98ba08fa0486c7ea016a2638267c77c077ec53bc72cbed75e5bf800189e69e1ce9a30d88a472dcf4d873230d

    • SSDEEP

      49152:rdHM4mZIx/fUhnFM9l8LodsIY8YWLsGbnOGkLCgv2MR:JHQGkkPtdsIY8YWYGbOTv2MR

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks