Extracted

• • Target

    b376df63007b8bd39491a8793fa544d42a734db1a332f9eaa0b3e1b81b2cba2e.exe

  • Size

    1.9MB

  • MD5

    a195d840e3ab5380441a4751fe4bca06

  • SHA1

    c474f61da91cec2e8482969027f15ac46b1da6c1

  • SHA256

    b376df63007b8bd39491a8793fa544d42a734db1a332f9eaa0b3e1b81b2cba2e

  • SHA512

    0c9fced06b6f55745b2f1cb7e626d8bda2a75f71f424e2080d23699b5c59fb1bc6292df74eb16363290a1a332957c8978fa4532f5c3ee3ca771d435478e6e93f

  • SSDEEP

    49152:EGlJfsXQN/ybRm3WHMwJIS+6Xf7mCo0B/NL1I5dlLYp:5hN/mRmGzljTXBKPYp

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2