General

  • Target

    d6fa4dd8ac9a9d8a164c35da0e0b7b80.bin

  • Size

    1.9MB

  • Sample

    230326-cebp1sfb75

  • MD5

    c645c5274b2d75446d4daf60211fc1bd

  • SHA1

    3e30657a4f33b15f326c811e5f153bdc342345fa

  • SHA256

    0f045c64d94d48c086aec12ca7a4f66e19baf27f149b3413a88bf8dd2b74585c

  • SHA512

    8de20f0451071f4aece7c3b60dc903c35fe960134f29ea284f7146227041320f2a678f808d13fd821b3f31dc07dc041b2710c3f2f0b212aef95ab5975f3d3f3a

  • SSDEEP

    24576:0Nkvfbhequho2irE633J/vR0VakSrhnuf3h8ScJA9q2DMb+7EEMv55zuM4wIUMfE:10SnrBJx61PpcAqMMb+7LMHBH0CVB

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      3f98c72ae30ee253d3fc2e00d37b7eb65e3b20c91f6b68715ae1559bb425d176.exe

    • Size

      1.9MB

    • MD5

      d6fa4dd8ac9a9d8a164c35da0e0b7b80

    • SHA1

      ee02c468663da5f9c2c58b3433186d6b50565e38

    • SHA256

      3f98c72ae30ee253d3fc2e00d37b7eb65e3b20c91f6b68715ae1559bb425d176

    • SHA512

      22d18a6ff317b2247823840cc9cf844dd060b3f1e6245dd308053ce9377e347da109083fce1452c268ba765d9055e9b92397a57a082c86a81fb554c8151e7cc9

    • SSDEEP

      49152:EGlJfs3UrAf76T/tvqN37mwt8wNtIYBGJqMOWtFQZUo75dlLYp:5c8I6/oxmwLwYGbtGFPYp

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks