General

  • Target

    file.exe

  • Size

    1.1MB

  • Sample

    230702-mkyf3scd2w

  • MD5

    fbfea617467d03515ac2a6baedce87c1

  • SHA1

    830c28207bf689f02d728b3b2643700cc8fb4c3b

  • SHA256

    e88259872bb2df0913c156511df3eba707e0a39f520fecd3316654c26cd05334

  • SHA512

    5da3bd14d8abb0716d1235b726a7e73df8abdffe77c8b428b70a7685cbddf2de65e5b9301fe479b57f39690c0240f2e7c4e09567ce8f677d4a9cf031227308af

  • SSDEEP

    24576:JfOy2xV+GXtP1PWpZu7tZTeL9dctfnNUWCMW6:JGR+0p3R8RWvT

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file.exe

    • Size

      1.1MB

    • MD5

      fbfea617467d03515ac2a6baedce87c1

    • SHA1

      830c28207bf689f02d728b3b2643700cc8fb4c3b

    • SHA256

      e88259872bb2df0913c156511df3eba707e0a39f520fecd3316654c26cd05334

    • SHA512

      5da3bd14d8abb0716d1235b726a7e73df8abdffe77c8b428b70a7685cbddf2de65e5b9301fe479b57f39690c0240f2e7c4e09567ce8f677d4a9cf031227308af

    • SSDEEP

      24576:JfOy2xV+GXtP1PWpZu7tZTeL9dctfnNUWCMW6:JGR+0p3R8RWvT

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks