gcleaner

General

Target

file.exe
Size

380KB
Sample

230404-nb1qhsgd3w
MD5

30b05e5b7fbc440221c4da9a84f9406d
SHA1

7d5544e825664f385d24b458b50f32c9d0212365
SHA256

f76ae21f9c62c095f082aba23fad1b575331a19fdb1376486b7354a784632985
SHA512

c934bf1cf09e8f557f5d294cbb5ae2f9bfa68cd5c2a065e9fb005ffb6804e6774a92d5c852d683ffb268d6bd18494ea7c6e0c680426402ec339a2322f6fe3f73
SSDEEP

6144:x/QiQXC2Jm+ksmpk3U9jW1U4P9bwOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZogE:pQi32s6m6URA3PhwlL//plmW9bTXeVh8

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/dfgg320/

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Targets

- Target
  
  file.exe
- Size
  
  380KB
- MD5
  
  30b05e5b7fbc440221c4da9a84f9406d
- SHA1
  
  7d5544e825664f385d24b458b50f32c9d0212365
- SHA256
  
  f76ae21f9c62c095f082aba23fad1b575331a19fdb1376486b7354a784632985
- SHA512
  
  c934bf1cf09e8f557f5d294cbb5ae2f9bfa68cd5c2a065e9fb005ffb6804e6774a92d5c852d683ffb268d6bd18494ea7c6e0c680426402ec339a2322f6fe3f73
- SSDEEP
  
  6144:x/QiQXC2Jm+ksmpk3U9jW1U4P9bwOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZogE:pQi32s6m6URA3PhwlL//plmW9bTXeVh8
Score

10^/10

gcleaner smokeloader socelars pub2 backdoor evasion loader persistence spyware stealer trojan
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2