gcleaner

General

Target

file.exe
Size

382KB
Sample

230224-paa9xada9x
MD5

fb795346665ad27af95872302e838827
SHA1

d0052de58344afe56ca0db5827fb5b713d568cdf
SHA256

ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3
SHA512

979dce9875488421683249f3e53b0da5b3a99411fa322e9e4ac6ea5e5b75f22f39e89439a2c07db61c5102715de03b9e5f88a2822a2f1b2341eabd15309cf502
SSDEEP

6144:G/QiQXCXWm+ksmpk3U9jW1U4P9bkGnrabJ4IcPjsdURNxA+B9HzQnQa421f/hPoX:+Qi3Xt6m6URA3PhknlRcbQZkTQpNhPoX

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sfasue20/

Targets

- Target
  
  file.exe
- Size
  
  382KB
- MD5
  
  fb795346665ad27af95872302e838827
- SHA1
  
  d0052de58344afe56ca0db5827fb5b713d568cdf
- SHA256
  
  ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3
- SHA512
  
  979dce9875488421683249f3e53b0da5b3a99411fa322e9e4ac6ea5e5b75f22f39e89439a2c07db61c5102715de03b9e5f88a2822a2f1b2341eabd15309cf502
- SSDEEP
  
  6144:G/QiQXCXWm+ksmpk3U9jW1U4P9bkGnrabJ4IcPjsdURNxA+B9HzQnQa421f/hPoX:+Qi3Xt6m6URA3PhknlRcbQZkTQpNhPoX
Score

10^/10

gcleaner pseudomanuscrypt socelars evasion loader persistence spyware stealer vmprotect lgoogloader rhadamanthys downloader
- Detect rhadamanthys stealer shellcode
- Detects LgoogLoader payload
- Detects PseudoManuscrypt payload
  loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- LgoogLoader
  A downloader capable of dropping and executing other malware families.
  downloader lgoogloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2