Extracted

• • Target

    e3dc16b03ce695935a8748555d63bf2209c8dad8cb85c7d81729f264ce03ffc1.exe

  • Size

    2.8MB

  • MD5

    c97df0511024d60d268dcc69bf4a95a0

  • SHA1

    351d0b12078a7e0accb80c6564316760d4c1abdd

  • SHA256

    e3dc16b03ce695935a8748555d63bf2209c8dad8cb85c7d81729f264ce03ffc1

  • SHA512

    b7fbbbfd36d84ffea4d00fc217bfad93309b1acfb6542baf09833a512ddefb318945bbd7fc2854e37c2a8dad004ad546c7419e2225e7f62c5c7032c508d216ad

  • SSDEEP

    49152:AGhVEhlZxvHZW3cX3o6F25voYhbFctwH7B2gbskms+w7Kawbb79chOKz:dh6hlZxvYq3o6wJeYBYAvab798OKz

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2