Extracted

• • Target

    Rec58.exe

  • Size

    1.8MB

  • MD5

    cea02e35a0a51717da4bd5838edad3f0

  • SHA1

    4a1b2a9a2273a8de1e4cf381a89bed175cc69281

  • SHA256

    f7bb81d45cd78f505f825111d54a19e66c9800e0ed6c616936dff59e421439bf

  • SHA512

    d4ca7f63cb784dc5e8a36cac0c59866fa71b5ce900d16d6fd29a2f605bb99889dc03b1c25a5ea8e650c0dfd8ab0fb7dd98578608140d5788b29af452566e618a

  • SSDEEP

    24576:LbDhhs34uU/SFFTWc3tO16VzF0MzscQsI9sA5oPFU5NR8mx2PPmrkX/4w5D:LbDhhs34uU/SFFicrFFscQsKR8Tlb5D

  Score

  10^/10

  gcleanerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2