Overview

overview

10

Static

static

1

2119b6ce47...89.exe

windows7-x64

10

2119b6ce47...89.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85f46d8248892a3b3341f49037c46ef1.bin

  • Size

    2.1MB

  • Sample

    230326-b3hykahb2s

  • MD5

    f1db15447170d17b1499c685b8aa898e

  • SHA1

    a1923185225378946842f44eed662a2e037ae020

  • SHA256

    fa1e4bcd0c7e7f799aa133884c66ec86bcb7f651e064726540a7394c70005a1f

  • SHA512

    08aacaa8cabdffc40be9f613e43252bb42058625c1aac05aa53e45ca8846deada36c984a11e3bf55affbdf5ebd60a480f6a135f6948d8b4e87af74cf4038f12d

  • SSDEEP

    49152:BSneDAlBKarDb4OTARTTKF0BxGTDeH3Pa8zEM/ZcUlO9VpdI:B0ebUgO0ZToPeXPcM/oRdI

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      2119b6ce4788e62047950f48e87a11196aa3e90fdf1c9ac9fa8c0705e90c6a89.exe

    • Size

      2.1MB

    • MD5

      85f46d8248892a3b3341f49037c46ef1

    • SHA1

      dee40cef47e97efa3e507c23e699619b0c179eb9

    • SHA256

      2119b6ce4788e62047950f48e87a11196aa3e90fdf1c9ac9fa8c0705e90c6a89

    • SHA512

      4118909bd5a53ef247be4335c86463dc4d880a15f5c97e7275fd5acff9d7ed42ac0e925b3a851356b6c6166ec26c3f128abb25301c92fef82fe2e37524d6315c

    • SSDEEP

      49152:EGlJfsg6DeVGLnMcHt970a9CQREv1x6fDipu1+lGOjSnKxpM5dlLYp:5RQ74ytiVQ6v76qu1+G4VePYp

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks