gcleaner

General

Target

file
Size

756KB
Sample

230222-q12efsbh42
MD5

a9926757f1a1882142e369cc4617d356
SHA1

07ef28c5842a5068619a6b30356e46cddbb4fda6
SHA256

d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934
SHA512

61ec6b4216dd6f9015825f71aa3f9decbde30e90a2bddac3cff5840573e36db62f7689f094c5aab196a8e52e41ec0f4e8c8b4ee20cafa80339284a72daa590b6
SSDEEP

12288:VQi3dMjv6m6URA3Phdp1hf39Wkv8xwJZ3Ep:VQiWjChhdpdUMZ0p

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sfasue20/

Targets

- Target
  
  file
- Size
  
  756KB
- MD5
  
  a9926757f1a1882142e369cc4617d356
- SHA1
  
  07ef28c5842a5068619a6b30356e46cddbb4fda6
- SHA256
  
  d182c08bed51b78f1dace83a6aa4bdb26954e7c89c9e7c8f8ae0992d6a315934
- SHA512
  
  61ec6b4216dd6f9015825f71aa3f9decbde30e90a2bddac3cff5840573e36db62f7689f094c5aab196a8e52e41ec0f4e8c8b4ee20cafa80339284a72daa590b6
- SSDEEP
  
  12288:VQi3dMjv6m6URA3Phdp1hf39Wkv8xwJZ3Ep:VQiWjChhdpdUMZ0p
Score

10^/10

gcleaner pseudomanuscrypt socelars evasion loader persistence spyware stealer vmprotect
- Detects PseudoManuscrypt payload
  loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2