General

  • Target

    file

  • Size

    1.2MB

  • Sample

    230701-sn2kssha23

  • MD5

    424c177d6e52272e7f7d2b8f2d094b2c

  • SHA1

    f0c972c9edc725c2b72a3f365a34de15e6de21e7

  • SHA256

    dfc754e4d0cb65246e8d8ba98fb4b79bc200960116292694417d08f158eea015

  • SHA512

    280e52ef20d2195a08f0b16427d50c6ffffc521ffd3293c365ed49094adc9ada44e64bd9d7d47fc4ef77ee74037580b3165abbc56107d948ecc95fabd7df84fd

  • SSDEEP

    24576:OfOy+60hyd6ZKQqExFfg/fF1fFbe9W1rARpJjBBp/D:OGe0UIkpExFfglZQm2pvBp

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file

    • Size

      1.2MB

    • MD5

      424c177d6e52272e7f7d2b8f2d094b2c

    • SHA1

      f0c972c9edc725c2b72a3f365a34de15e6de21e7

    • SHA256

      dfc754e4d0cb65246e8d8ba98fb4b79bc200960116292694417d08f158eea015

    • SHA512

      280e52ef20d2195a08f0b16427d50c6ffffc521ffd3293c365ed49094adc9ada44e64bd9d7d47fc4ef77ee74037580b3165abbc56107d948ecc95fabd7df84fd

    • SSDEEP

      24576:OfOy+60hyd6ZKQqExFfg/fF1fFbe9W1rARpJjBBp/D:OGe0UIkpExFfglZQm2pvBp

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks