Extracted

• • Target

    789633ecdfd15766a3bf12ee30d79a5ace11e744add8f0f605018dd06878605b.exe

  • Size

    2.1MB

  • MD5

    756f949bee32f19ffa0ad1ba8748721b

  • SHA1

    a6f7b78773bfa2423b26f4e93c2bed668ee86a51

  • SHA256

    789633ecdfd15766a3bf12ee30d79a5ace11e744add8f0f605018dd06878605b

  • SHA512

    273bc673362859d37cff9dadd8f8af80d665ce43c34e1d9b00d25bf042ee4120b8adea7adf9b15ad9323337e55e0765f3235708bc30a67d6b0c13e7ae6767817

  • SSDEEP

    49152:EGlJfsM5NEe49PfLOx/kCW2QXtkBdYiwYYTRE9F93MYCs1z5dlLYp:5lEeMa+CxIcdJFv3hHPYp

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2