Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    2MB

  • Sample

    230324-zqex5shc93

  • MD5

    85f46d8248892a3b3341f49037c46ef1

  • SHA1

    dee40cef47e97efa3e507c23e699619b0c179eb9

  • SHA256

    2119b6ce4788e62047950f48e87a11196aa3e90fdf1c9ac9fa8c0705e90c6a89

  • SHA512

    4118909bd5a53ef247be4335c86463dc4d880a15f5c97e7275fd5acff9d7ed42ac0e925b3a851356b6c6166ec26c3f128abb25301c92fef82fe2e37524d6315c

  • SSDEEP

    49152:EGlJfsg6DeVGLnMcHt970a9CQREv1x6fDipu1+lGOjSnKxpM5dlLYp:5RQ74ytiVQ6v76qu1+G4VePYp

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file.exe

    • Size

      2MB

    • MD5

      85f46d8248892a3b3341f49037c46ef1

    • SHA1

      dee40cef47e97efa3e507c23e699619b0c179eb9

    • SHA256

      2119b6ce4788e62047950f48e87a11196aa3e90fdf1c9ac9fa8c0705e90c6a89

    • SHA512

      4118909bd5a53ef247be4335c86463dc4d880a15f5c97e7275fd5acff9d7ed42ac0e925b3a851356b6c6166ec26c3f128abb25301c92fef82fe2e37524d6315c

    • SSDEEP

      49152:EGlJfsg6DeVGLnMcHt970a9CQREv1x6fDipu1+lGOjSnKxpM5dlLYp:5RQ74ytiVQ6v76qu1+G4VePYp

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks