gcleaner | 1a050f9f569c84e6082a19ffef91491eb4837460b5eb276c641a19692c763a87 | Triage

Sharing

General

Target

1a050f9f569c84e6082a19ffef91491eb4837460b5eb276c641a19692c763a87
Size

2.1MB
Sample

230315-psklasdb46
MD5

967f9770c9085892a0c56a52962eecd2
SHA1

ffb66ed3e060059dabb9419c2fc604c5ba8ada72
SHA256

1a050f9f569c84e6082a19ffef91491eb4837460b5eb276c641a19692c763a87
SHA512

dfe6b30263148c46cde484c90885408182d1b915bc5064784f8e0ca3cfa2c27d46e01bc6ff8755904384af682e05398692cb1f6760b1851cced782e09f2c34a4
SSDEEP

49152:M2+OuWiGuM3/oH9OEoO2yzgBIo1PXEN0ZiyLxAII/m/WahOVLM0:h3xiGuUgHkEoZ6gBV9X9h/JhOVLM

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

C2

45.139.105.171

85.31.46.167

107.182.129.235

171.22.30.106

Targets

- Target
  
  1a050f9f569c84e6082a19ffef91491eb4837460b5eb276c641a19692c763a87
- Size
  
  2.1MB
- MD5
  
  967f9770c9085892a0c56a52962eecd2
- SHA1
  
  ffb66ed3e060059dabb9419c2fc604c5ba8ada72
- SHA256
  
  1a050f9f569c84e6082a19ffef91491eb4837460b5eb276c641a19692c763a87
- SHA512
  
  dfe6b30263148c46cde484c90885408182d1b915bc5064784f8e0ca3cfa2c27d46e01bc6ff8755904384af682e05398692cb1f6760b1851cced782e09f2c34a4
- SSDEEP
  
  49152:M2+OuWiGuM3/oH9OEoO2yzgBIo1PXEN0ZiyLxAII/m/WahOVLM0:h3xiGuUgHkEoZ6gBV9X9h/JhOVLM
Score

10^/10

gcleaner discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

gcleanerdiscoveryloader

behavioral2

gcleanerdiscoveryloader