Overview

overview

10

Static

static

1

51d0d06d90...4d.exe

windows7-x64

10

51d0d06d90...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7daca5309b3b5a4be2ce182fa7718cf0.bin

  • Size

    2.8MB

  • Sample

    230311-b1m5haga93

  • MD5

    a27274cd6ccec6b8944109446535585c

  • SHA1

    ae3c0ab594c8761ec5c3be6bc48b4952ef4ce20d

  • SHA256

    cda6818823aba9d8123660a619b6fb0c12d2557c582f1e3a1938b7d77329c422

  • SHA512

    cf85305b4bc0bc9b56275d7d2179d24393cff91c1cddc7e1fb8fd2987ba671a85335a3704ae880115e1bf67c30a7435fed113eb869ca20cd8ad1b7707307bd85

  • SSDEEP

    49152:gj7pg6JnYJjgI72dYslv+CTYO4MEVr5Eip6Fqwj/mKeHyz08YmsZzR:gBg6JnYJjgIkllh3M5E3fj/G8YvZzR

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      51d0d06d903494a384ce7c2b89e7ab2d132b760a105a2e355b9bfa26c7bf5c4d.exe

    • Size

      2.8MB

    • MD5

      7daca5309b3b5a4be2ce182fa7718cf0

    • SHA1

      8f6547742beff6e9f540be202fbac793183e79dd

    • SHA256

      51d0d06d903494a384ce7c2b89e7ab2d132b760a105a2e355b9bfa26c7bf5c4d

    • SHA512

      4440241aa421f0da49830215b2b81e4ae53a7f738ebf23c2353e56bb585cd7f67a1d2f1c4f2f9ad7c928dfc5a2b2f43907b238c20b84cdf9a0bc0797f8a64fa5

    • SSDEEP

      49152:AGzyci6zfupg3wUb0H3wewP4mTdwMH0Y0rwnDmZ6cEJOMqPJI23PgcWozvbYc7xz:dE68XUb0XD0dwUgwnD1ZFqKcPgo8c7xz

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks