Extracted

• • Target

    c3c372d8f8bb81cf47aa95b668db4ec994acb075a3f6c5b1d2ec04593dc05442.exe

  • Size

    2.3MB

  • MD5

    15f7afaacde0ad19992e41c867cf0e88

  • SHA1

    b8fcd6b953a8b42fb535f6c436d3f09fd0139d0c

  • SHA256

    c3c372d8f8bb81cf47aa95b668db4ec994acb075a3f6c5b1d2ec04593dc05442

  • SHA512

    154ba4b4ede295d65fe416607c5ad5cd1e53808caca3260a9db131eb840bfc07b7622e666e139c4259a8d543d4954d53314685889d70cc6ce1c7b9ae1b3fd4c8

  • SSDEEP

    49152:J6dJ6sPlszWm+02k3fx/nAdXkYH/C8S4pSGr1tqWK1lCirZ+/TnL8Z6duee1g7I9:cdMstkNJ/rYH/v3pjr1tqWK1lC0+TnLY

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2