Extracted

• • Target

    file.exe

  • Size

    2.5MB

  • MD5

    ee16c1406030beb2edee77f2d7b3d3cb

  • SHA1

    60d38af685fc9563b16b2406ba9756215dd0e892

  • SHA256

    66af91092625c63986ef790221f86b0debbcc43753a2d919b4d315c7670daa35

  • SHA512

    edc500fbb3d45b93a6d7dd1ed7a16ef012c78da26b1e912d0acd9a108ad80a19ed1100746f13d7e938cd25ce6232632d826cf8a139a0ecaf16f67dae7731a82e

  • SSDEEP

    49152:rdHomp/2hma+7vdQyqQ4YjybMpmJ0A+QcJPLTa0aajJLC0FyjltLCgv2MR:JHomu++yqfYjyb8mE7jG0acE0Fy5xv2Y

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2