gcleaner | ad414c6d1a9a213b17c12f0780430e11697341479c191fe22df8f1e7a06a7df9 | Triage

Sharing

General

Target

ad414c6d1a9a213b17c12f0780430e11697341479c191fe22df8f1e7a06a7df9
Size

1.7MB
Sample

230315-pqpggadb37
MD5

b3c6b147f5790fe8d98061ff63a850ce
SHA1

02517f38bb94a85c2d1e19f4425fc411d9bda524
SHA256

ad414c6d1a9a213b17c12f0780430e11697341479c191fe22df8f1e7a06a7df9
SHA512

61d15af1ea06653dc881e8e421972c0e3fc923e7bad134e1cf51e533ae03525669c0e19d1c0adb0dff9e2a693ab0b4d0c898a0e2b50d5d612e21ddc70cd5a682
SSDEEP

24576:q205x+A8D5aqlEZcWZhJdvgwWTuCSNo9+uX8PoZZbpbOWwFgXC75ld1qSVpNyn:q2FIyScIqQS9+2P1paVd1qap+

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

C2

45.139.105.171

85.31.46.167

107.182.129.235

171.22.30.106

Targets

- Target
  
  ad414c6d1a9a213b17c12f0780430e11697341479c191fe22df8f1e7a06a7df9
- Size
  
  1.7MB
- MD5
  
  b3c6b147f5790fe8d98061ff63a850ce
- SHA1
  
  02517f38bb94a85c2d1e19f4425fc411d9bda524
- SHA256
  
  ad414c6d1a9a213b17c12f0780430e11697341479c191fe22df8f1e7a06a7df9
- SHA512
  
  61d15af1ea06653dc881e8e421972c0e3fc923e7bad134e1cf51e533ae03525669c0e19d1c0adb0dff9e2a693ab0b4d0c898a0e2b50d5d612e21ddc70cd5a682
- SSDEEP
  
  24576:q205x+A8D5aqlEZcWZhJdvgwWTuCSNo9+uX8PoZZbpbOWwFgXC75ld1qSVpNyn:q2FIyScIqQS9+2P1paVd1qap+
Score

10^/10

gcleaner discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gcleanerdiscoveryloader

behavioral2

gcleanerdiscoveryloader