Extracted

• • Target

    a41e45e14795bb60ef20aa47780ddd8cdc491e7e23c16594a7af91c4f3e817cd.exe

  • Size

    2.4MB

  • MD5

    dd57d3e8aa35f0b8218af7af8f3a65e7

  • SHA1

    5f5980c3c94aca9ca9011505a003fe7b9c8217bf

  • SHA256

    a41e45e14795bb60ef20aa47780ddd8cdc491e7e23c16594a7af91c4f3e817cd

  • SHA512

    ab753c9aaa387863feaffd1d77da231d42450f1c6cd91a716ae03b7b770264fb50ba28d18f91614306a4ab29d5c56a3c38826d68f96a9e21f5c0c6f2d97901a8

  • SSDEEP

    49152:EGlJfse+Lz4cMzjsb0MAb8MIYHKeTxmRL6yQtV6rWfXw+aYy6+g54d5dlLYp:5j2z4PzjsbGIQaREEOAIL+gCrPYp

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2