Behavioral task
behavioral1
Sample
588-104-0x0000000000400000-0x0000000001555000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
588-104-0x0000000000400000-0x0000000001555000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
588-104-0x0000000000400000-0x0000000001555000-memory.dmp
-
Size
17.3MB
-
MD5
9566edc86f7f0fd30c4390acfa61c33a
-
SHA1
1883e198354e00b29caf733cddee962cc5096316
-
SHA256
d16ca6fe7ff9a9190125accf1900189a521813f0d4440b8fd00f5981722b2b49
-
SHA512
24ddf3f7b42f9d993451dff9dbccbac65800cb16bae4d67b91de9c482109e7618cc0f802e412f30901c24db96b28adad82d37570363fd0356a8f76f5e9f9ff3f
-
SSDEEP
12288:msYSsp5R3j0Tj4XaW4I7NM0B9a0PyBLOSfmitG:S3JNBoISOT
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
588-104-0x0000000000400000-0x0000000001555000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ