Overview

overview

10

Static

static

1

f9975a04e4...be.exe

windows7-x64

10

f9975a04e4...be.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9975a04e4f1d9933677c0afa1c705ab713ee974a9a61eec69b0c4fb20c62abe.zip

  • Size

    2.8MB

  • Sample

    230310-q2jwssfg2t

  • MD5

    f86f3074bac98c37feafb5e479debe2d

  • SHA1

    1ee1874ad9e31c8c50093e1988c5024a57038fc1

  • SHA256

    ab617cc2bfca121f561f81d20f9b9ec11c46b16d4694eeaf46664aa46b2e4124

  • SHA512

    fcf0f1d1e35ed35b1935abecac2b525a8843eb1b977a4858a7908397e5b56d859c38190328b83152d5f460dcffad14ccafd811e08d5cc95df23536699da13596

  • SSDEEP

    49152:6rK1TVEt/gaqGFnQyAArCfDAivVGSVVDF8Oel3vkhIrw+zWhEjdXtKSYVkNwZPbM:6r+xE4GFxTeDzvVGgvte+U9CQZIfkqZg

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      f9975a04e4f1d9933677c0afa1c705ab713ee974a9a61eec69b0c4fb20c62abe.exe

    • Size

      2.8MB

    • MD5

      0a177aa69e2b8c90894ea4c5673f0c60

    • SHA1

      000adc732fbd964e31d9940d9b23b8d181632097

    • SHA256

      f9975a04e4f1d9933677c0afa1c705ab713ee974a9a61eec69b0c4fb20c62abe

    • SHA512

      d2248181b9388ffcdcccc94f7413dbc1c114f9e47462231fe8bc60ff5d24ac9c7f501975571773fe18cec5a631a63ec5a8c4b9e444005f07ece3fc52fd007879

    • SSDEEP

      49152:AGKtG7/LPbNcGcXsN7H4FUnX4oGMw8qDAD/xWGHO8bkdOKz:drzLPicZYOfDDEGHOKkdOKz

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks