gcleaner

General

Target

8786b658cc8531383511362b788f8f1c.bin
Size

374KB
Sample

230309-bxjynsaa54
MD5

6e6293c62717a4b3a32339131a137216
SHA1

9cac56e87f9032b83ee4ec42c2f477dabb22cc27
SHA256

8f136de62431644377a9d55563721cf4bb2b99d5942c2ccc272a28a4eac318c7
SHA512

bf044d64ea959d46ac1c930096aeec84bf5218e2130f4d20a3327db1f1a51c5f55e19397d8a25739c62f429a51aa64fc6f80e0c78e89120fd23611cd5f962c7d
SSDEEP

6144:hHmlzozVYiJqC9PoBGioyaoS0ysGXBW3PgF/G3Omi6RU0040heGlV8v4SmQyoxIc:xm+zH59+XS0ysoBdAO16RU0rGE4TNox/

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sadef33/

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

- Target
  
  ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe
- Size
  
  396KB
- MD5
  
  8786b658cc8531383511362b788f8f1c
- SHA1
  
  58da30ee843e7d5f51bdacca1ea495b84a7678fd
- SHA256
  
  ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059
- SHA512
  
  d99b28db09067135359de87244a56d039399591d29c0bcf8c7d2163f934a938c4248239d87fcb6e99b9f0bce7132e95d0581ae32e73603af489f8b1444a44f5f
- SSDEEP
  
  12288:iQi3Qa6m6URA3PhNOZm2K7YOY5p2tpNnnTIg:iQiA5hhVFf4y3Tp
Score

10^/10

gcleaner pseudomanuscrypt socelars evasion loader persistence stealer spyware
- Detects PseudoManuscrypt payload
  loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2