gcleaner

General

Target

tmp
Size

50.3MB
Sample

230620-xw9ctsdg98
MD5

055cd3d8cd94b3ca5093ed3692e6ae40
SHA1

1e672ddff4f85c998bdb02bb98bae55b87bc0073
SHA256

a3582918024fb85fe4a2eeeaddb5c14b210cb7c90fe7d262cacbec048e6a470f
SHA512

d2781867dc1638f1f717a67eb9c99acf8b40915f11513e3bbcad005203a6334e528113f977f6ac7284418f64e669abacc818221b9fe32e357fc5a6680f93152a
SSDEEP

1572864:mVOgHnI7e0HIFGmLhTW7mDlQHAxlA4nxt6:SZyo/LAmRgAFy

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://sungeomatics.com/css/colors/debug2.ps1

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Targets

- Target
  
  tmp
- Size
  
  50.3MB
- MD5
  
  055cd3d8cd94b3ca5093ed3692e6ae40
- SHA1
  
  1e672ddff4f85c998bdb02bb98bae55b87bc0073
- SHA256
  
  a3582918024fb85fe4a2eeeaddb5c14b210cb7c90fe7d262cacbec048e6a470f
- SHA512
  
  d2781867dc1638f1f717a67eb9c99acf8b40915f11513e3bbcad005203a6334e528113f977f6ac7284418f64e669abacc818221b9fe32e357fc5a6680f93152a
- SSDEEP
  
  1572864:mVOgHnI7e0HIFGmLhTW7mDlQHAxlA4nxt6:SZyo/LAmRgAFy
Score

10^/10

gcleaner glupteba rhadamanthys smokeloader pub1 backdoor discovery dropper evasion loader stealer trojan upx bootkit persistence ransomware spyware
- Detect rhadamanthys stealer shellcode
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Modifies boot configuration data using bcdedit
- Blocklisted process makes network request
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2