gcleaner

General

Target

Driver Easy Pro Crack.exe
Size

2.0MB
Sample

230323-vt4cpaba9t
MD5

324db70fad161852fb9a12b202b6c8ad
SHA1

59dc865fdb633a2febe6a0fa763b3ecaf7b9ff87
SHA256

696c1b503eda75df91c227a8dcf5eb434f0c5463377be527119cb094f1f13d5a
SHA512

03e90eb31c92db811f557b8af4c1f405e8f317407bd0e3b3b48e7482d2f541908dcfa929886f5124362c861ee3a2fffc0615b585c56cfe93a02ebfc007905188
SSDEEP

49152:dJ4gqdPiqPHnCD10qnMFA9vDDovbp6PArwj:dJ4zbPHQ0yMG/srrwj

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://neutropharma.com/wp/wp-content/debug2.ps1

Extracted

Family

raccoon

Botnet

81620d6b0f6e4fbb3048818577e1f9be

C2

http://91.201.115.148

rc4.plain

Extracted

Family

redline

Botnet

UStest3

C2

hrabrlonian.xyz:81

Attributes

auth_value
8716b0d35e500edf1e4d6a9137842891

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

Targets

- Target
  
  Driver Easy Pro Crack.exe
- Size
  
  2.0MB
- MD5
  
  324db70fad161852fb9a12b202b6c8ad
- SHA1
  
  59dc865fdb633a2febe6a0fa763b3ecaf7b9ff87
- SHA256
  
  696c1b503eda75df91c227a8dcf5eb434f0c5463377be527119cb094f1f13d5a
- SHA512
  
  03e90eb31c92db811f557b8af4c1f405e8f317407bd0e3b3b48e7482d2f541908dcfa929886f5124362c861ee3a2fffc0615b585c56cfe93a02ebfc007905188
- SSDEEP
  
  49152:dJ4gqdPiqPHnCD10qnMFA9vDDovbp6PArwj:dJ4zbPHQ0yMG/srrwj
Score

10^/10

gcleaner pseudomanuscrypt raccoon redline 81620d6b0f6e4fbb3048818577e1f9be ustest3 infostealer loader stealer
- Detects PseudoManuscrypt payload
  loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Blocklisted process makes network request
- Downloads MZ/PE file
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Uses the VBS compiler for execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1