Behavioral task
behavioral1
Sample
1160-55-0x0000000000400000-0x00000000004CD000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1160-55-0x0000000000400000-0x00000000004CD000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1160-55-0x0000000000400000-0x00000000004CD000-memory.dmp
-
Size
820KB
-
MD5
bbe2d2ecb1da292b3ae7c59df76d42fe
-
SHA1
6b2ced83bb689ee7604d56d1d0e0efa3576ebaa9
-
SHA256
1b1751f3b27eef0d21fd76a806f2738f8c601b6e4aabfb7aefd03d2505c57684
-
SHA512
d8649136989d110b519869c574bfd6abd16ecc6b1412b6d1205ada34a68a449e246daf5ce4497a4620138b65eafd82e5bbbe877550d110cff2e24df64c890165
-
SSDEEP
6144:yrRA8uQPFDeueWsCUCWT6LCICVOWM4tIP8SicqwAOQ43eoGU:yrRAoPFDeueWHUCWTVB4iIPe
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Gcleaner family
Files
-
1160-55-0x0000000000400000-0x00000000004CD000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ