Extracted

• • Target

    9abddbc730703542ff090d2a01ef1aec169b5b3ba6e85891383ae1893f5a6ffa

  • Size

    2.8MB

  • MD5

    7a2b1fab546a381df312e2668bfd11f6

  • SHA1

    2b7a406edf6e14f48f070f5680f982335c2daa64

  • SHA256

    9abddbc730703542ff090d2a01ef1aec169b5b3ba6e85891383ae1893f5a6ffa

  • SHA512

    2ca699345762c926bcb04d324dc206fe64413dd97c084eca416313081d773fd24a3f9843243135fc703219052c84a7adff93d1407d40d9ae22e0de5140f5fd76

  • SSDEEP

    49152:AGHYaLuZjHIO7uFs7BDpoVTmuFpF3+gsroolJyx779r+W4+WkaCUf4Y6H0c2FTym:ddcHIEmKBDpoIGFps89x9yx+WCEZKq9z

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2