Overview

overview

10

Static

static

1

73ba62cba3...3b.exe

windows7-x64

10

73ba62cba3...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b085ff032424f75a96d2b27bf595993d.bin

  • Size

    2.8MB

  • Sample

    230313-m9s8naaa97

  • MD5

    55eb0460fb29f986c2e949c224f5c78e

  • SHA1

    a5b4c524ac2389744a8d2a76db7a222c0868edee

  • SHA256

    207b03464dca45e73e13688e321538cd7def9ccb77f7f2fb1929ef7f4e4a30dd

  • SHA512

    71a61f161e7f2c9bea8b2ed4d27c0af91623969fbb3b8618a8cb2fc4a530e0b34b8b114e4f68b4d43d5c675bb9b0b6edae16ea57d31d4fe16585c18fe171ea5c

  • SSDEEP

    49152:x+yV/akTG0J0iT8CPhMEPXm1pkNim4nsjwrjKRN9yFXgLpBUwW1:A6xTGPribXmrkQxsUvKRNCwLpBUP1

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      73ba62cba32b3737dc24ba697a638848ca97df33d4e3ebe87debeb3c140de23b.exe

    • Size

      2.9MB

    • MD5

      b085ff032424f75a96d2b27bf595993d

    • SHA1

      3a555104add6236870e7a1555c1a7e4ca2f7c4af

    • SHA256

      73ba62cba32b3737dc24ba697a638848ca97df33d4e3ebe87debeb3c140de23b

    • SHA512

      c4598f44e5f5b976fd802ab6118bbfce03ebf6ebab542a845394e24087352f3ef46aea2c84e9e7f053fd80c507654077c3063447b3104fbadbac87bdf194a1d2

    • SSDEEP

      49152:AGdcptDCQLO5IfemIjf0Fita138FjwlSnefJXN5V4jEHcb3cNgzf6yLoOKz:dOHD/OGfevAFiIt81wlhRd5VIMCr2OKz

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks