Overview

overview

10

Static

static

1

51d0d06d90...4d.exe

windows7-x64

10

51d0d06d90...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51d0d06d903494a384ce7c2b89e7ab2d132b760a105a2e355b9bfa26c7bf5c4d.zip

  • Size

    2.8MB

  • Sample

    230310-m2v3aaef9v

  • MD5

    224ec28bb1b090f06be31f7d20e466c7

  • SHA1

    9bff01332ccbd49c5a7862f7ceae3a8d7b385dea

  • SHA256

    a0e7eb289b373b6a1d9c130d599c544317b757f28ae47f23f6c93d982b3f4895

  • SHA512

    eb5eb25a8f07bac970743b9d1d9223aa394aa170c6151ce98527257759339154500d78edf003894a7b330a00a700427a66eb2e023c5915294ecb26cc50bf43fd

  • SSDEEP

    49152:aXv0ThvxmvXGExXI1R0naOfH7c/ZTDFUcj6a+KLAdjXjUojuz+nAgL8qW:afQvsM1y4/BhnOSjo6+nNLY

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      51d0d06d903494a384ce7c2b89e7ab2d132b760a105a2e355b9bfa26c7bf5c4d.exe

    • Size

      2.8MB

    • MD5

      7daca5309b3b5a4be2ce182fa7718cf0

    • SHA1

      8f6547742beff6e9f540be202fbac793183e79dd

    • SHA256

      51d0d06d903494a384ce7c2b89e7ab2d132b760a105a2e355b9bfa26c7bf5c4d

    • SHA512

      4440241aa421f0da49830215b2b81e4ae53a7f738ebf23c2353e56bb585cd7f67a1d2f1c4f2f9ad7c928dfc5a2b2f43907b238c20b84cdf9a0bc0797f8a64fa5

    • SSDEEP

      49152:AGzyci6zfupg3wUb0H3wewP4mTdwMH0Y0rwnDmZ6cEJOMqPJI23PgcWozvbYc7xz:dE68XUb0XD0dwUgwnD1ZFqKcPgo8c7xz

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks