Overview

overview

10

Static

static

1

3aa97a5e2d...c5.exe

windows7-x64

10

3aa97a5e2d...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3aa97a5e2d24316daca7529266216886cf888b6643b77c1e6c51ea42600e61c5.zip

  • Size

    204KB

  • Sample

    230310-njzhesfa8y

  • MD5

    4e57408bdabe3f633a0e73e471254bc6

  • SHA1

    88140d95aa8253d074e0a23c5a3690886573c90e

  • SHA256

    d99a96df8ae80f5de78dd165b9e595233f51e06df8e30bba5229e4b8d04a6a60

  • SHA512

    a2962981b0486e2df1a4eac5abc6edba004a006a2460b409591c8e5b775fbae6d258e10c6a78eca6db2cc84af8952c0af4bb412169f464c6a495c3e48b2dbe24

  • SSDEEP

    6144:9zrhhx/OP2xAc2KbJq54TftEZPmh1YsGfSn:9zr7gPF1KbJq54rtgaVn

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      3aa97a5e2d24316daca7529266216886cf888b6643b77c1e6c51ea42600e61c5.exe

    • Size

      270KB

    • MD5

      0e64802a39def8b062a90ac724456d44

    • SHA1

      7745f11285f663d01c01bfb55e230f7a871e7f52

    • SHA256

      3aa97a5e2d24316daca7529266216886cf888b6643b77c1e6c51ea42600e61c5

    • SHA512

      1d684bc2de3bae0b50e3fd15dd3824e40ae5ee22c6983378c76f06d248f77d2dc231eb04ce5f880db400ea7b54da4914491df2d4006f18b89fcfaa3b1b947906

    • SSDEEP

      6144:l6GXXyJP2yz6cWUcoKBPnjoc8vO+Tn849:gqCJP2ylWn9jmLr

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks