Behavioral task
behavioral1
Sample
936-55-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
936-55-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
936-55-0x0000000000400000-0x0000000000460000-memory.dmp
-
Size
384KB
-
MD5
2561bf791c5b2a5027e81b7989290827
-
SHA1
99e2e71524e969a3ca201d453edc6037804d8a7d
-
SHA256
4523d2f279e5d5074dbe5c11640ab2afa7f04513d36fc3497cb055742b7e3070
-
SHA512
9c8eabf0dff8f840241e94036a83c4a635823ba16260f1bda3a97cca07f4cc74dc411ca54c1c5d78fc3873c1870b0220e277a9c16fde76296016c1df6eeb82b8
-
SSDEEP
6144:yrRA8uQPFDeueWsCUCWT6LCICVOWM4tIP8rcqwAOYl3e:yrRAoPFDeueWHUCWTVBFIIe
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
936-55-0x0000000000400000-0x0000000000460000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ