Extracted

• • Target

    541a0a654aaf401eb55c7a96daef2542d56c64331148b7a9680359eccc750469.exe

  • Size

    2.8MB

  • MD5

    3671fefaea7820881fbe38ae64571809

  • SHA1

    bbeb62bbc94710a2cf5d20795c6efc3b2fc953df

  • SHA256

    541a0a654aaf401eb55c7a96daef2542d56c64331148b7a9680359eccc750469

  • SHA512

    16142f5a5b72b8f03af6014c2becc08657365d4af965cc4ba48fe318a927884385c1c10022b1d55d08722185e6d2f04462d7a58ffedf26e745adfa43460ba019

  • SSDEEP

    49152:AGtvc9miqAeRj1YXxopMOH3JQ+xf/Ii1GH3HoVOUED3BGVx/Ma8+Kkw56zNOKz:dyURxT3W+xl1GXHyOZuBMT/kQ6zNOKz

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2