Overview

overview

10

Static

static

1

e3dc16b03c...c1.exe

windows7-x64

10

e3dc16b03c...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3dc16b03ce695935a8748555d63bf2209c8dad8cb85c7d81729f264ce03ffc1.zip

  • Size

    2.8MB

  • Sample

    230310-m2q4bsda32

  • MD5

    871d7b997fb78f24b1d01c26aaae466a

  • SHA1

    e393431006e4a00bce29f9b754aef4d766a47e10

  • SHA256

    18935473c9823e38df6a19f6d826af317f950d286755620e27158779242f525c

  • SHA512

    007bb47e12e0989a9d2cfea5fd749e8e1c61b4f4719d4f45a233d9255b38a2ac7db370ba52c3d616ddc82e826482240985a3d5bea382b0505fd0773146b24264

  • SSDEEP

    49152:KNNvWXx5UpY/xHBeasbTEZZD5RsX7ljWZbKuBEwXX+kmxKah8+a0zbu/ar4af1j5:6NvyUpgeas3EzWjW3EwXX+koi4zbu2V5

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      e3dc16b03ce695935a8748555d63bf2209c8dad8cb85c7d81729f264ce03ffc1.exe

    • Size

      2.8MB

    • MD5

      c97df0511024d60d268dcc69bf4a95a0

    • SHA1

      351d0b12078a7e0accb80c6564316760d4c1abdd

    • SHA256

      e3dc16b03ce695935a8748555d63bf2209c8dad8cb85c7d81729f264ce03ffc1

    • SHA512

      b7fbbbfd36d84ffea4d00fc217bfad93309b1acfb6542baf09833a512ddefb318945bbd7fc2854e37c2a8dad004ad546c7419e2225e7f62c5c7032c508d216ad

    • SSDEEP

      49152:AGhVEhlZxvHZW3cX3o6F25voYhbFctwH7B2gbskms+w7Kawbb79chOKz:dh6hlZxvYq3o6wJeYBYAvab798OKz

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks