General

  • Target

    file.exe

  • Size

    2.4MB

  • Sample

    230210-yhh46ahh84

  • MD5

    72ffa27ba78ef6d71d4a9c43a18c36a9

  • SHA1

    369865fb28250b89d50f496547fe271ba6336801

  • SHA256

    4ff57c06c7ce69555aab48c0ff09bcbee9f96a82c639bb92205f82f95f4d2474

  • SHA512

    4802f2145f260ce8323ddfef3bf159d6482eebb9c399b406c44a5df232d5f362d149e89f7f0e6e7f410ac6c17cef7ddc0f610e55333686f94c7d3c5c47941864

  • SSDEEP

    49152:rdHCOs1CAU1DEBhXcGrG7zfxecscSdsJKkUnCLCgv2MR:JHCnjU14BNG7NycMsokEqv2MR

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file.exe

    • Size

      2.4MB

    • MD5

      72ffa27ba78ef6d71d4a9c43a18c36a9

    • SHA1

      369865fb28250b89d50f496547fe271ba6336801

    • SHA256

      4ff57c06c7ce69555aab48c0ff09bcbee9f96a82c639bb92205f82f95f4d2474

    • SHA512

      4802f2145f260ce8323ddfef3bf159d6482eebb9c399b406c44a5df232d5f362d149e89f7f0e6e7f410ac6c17cef7ddc0f610e55333686f94c7d3c5c47941864

    • SSDEEP

      49152:rdHCOs1CAU1DEBhXcGrG7zfxecscSdsJKkUnCLCgv2MR:JHCnjU14BNG7NycMsokEqv2MR

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks