General

  • Target

    cbd8b305092414c89d7c5e2b0c4975ea.bin

  • Size

    1.9MB

  • Sample

    230327-cnrslabc38

  • MD5

    0400ede15bda09c590b823a64b221bb2

  • SHA1

    8de0a6c7ad5db3aebe832692e9b68af19c8e7826

  • SHA256

    6462bf51b4d88d6013656804c21a535c2d27c09d7dcbdf1f212b10f116c324e5

  • SHA512

    6b05cfaaa62559f66bbca2b6a4e1903203bbc80e5cce3a8f38b77abc0d17dc5598ebdc9e90dc7f2cc7016eee1e370b08a14f104104fafe9d51078012473531a7

  • SSDEEP

    24576:z2TvLPmDld3Uike6wbPmQl8RY0lwfOYC6jbhN79YuXgliqLVvlhrGB3IYGTJ4Z:qLuBd3Ui7ZIYA1ynz9YuXkPrGeBTJ4Z

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      2a8fdd6a69c03c5a536b9c560a65b6d25056c69416e952c51e9a3de4ed2fa2f0.exe

    • Size

      1.9MB

    • MD5

      cbd8b305092414c89d7c5e2b0c4975ea

    • SHA1

      b0800cb3962a493f783805fe8e00692fcef8edaa

    • SHA256

      2a8fdd6a69c03c5a536b9c560a65b6d25056c69416e952c51e9a3de4ed2fa2f0

    • SHA512

      f098a54828773789293762958f2330f5f00e9e91472f57386954436c204675d8e48b063ce1e3fd7a93a9b1c8cbc97adb588c30fcf1d5cad263655a59fa1aaff7

    • SSDEEP

      49152:EGlJfs4PMjsf2rhEjfh6aOjHAK4EuSK5dlLYp:5IrhUfgjgZEroPYp

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks