General

  • Target

    file

  • Size

    1.1MB

  • Sample

    230703-2dtxmsbg4v

  • MD5

    9ddf974cd4a3ea708030877c5c0c2507

  • SHA1

    c3240a49398d782cf6434768846ca67587ae4a49

  • SHA256

    318e562f61065bc7267d4d75784997b76c5683948492eb73d65f1fca100d6f5e

  • SHA512

    68f859eff1db41553bbe6d2039a4a75d3daa2a58ae5c0b58d3b8d49d77fdcd58fabef177c8a67cf249fc970b823f43558ff3f650845278d906b47317734d5552

  • SSDEEP

    24576:VfOyEXMJKJqR1lIRs2/rsZdFjyiUP29ThVfcyNK+orqtP/O1:VGFMJT6RXwZDjNUYfcg95/O1

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file

    • Size

      1.1MB

    • MD5

      9ddf974cd4a3ea708030877c5c0c2507

    • SHA1

      c3240a49398d782cf6434768846ca67587ae4a49

    • SHA256

      318e562f61065bc7267d4d75784997b76c5683948492eb73d65f1fca100d6f5e

    • SHA512

      68f859eff1db41553bbe6d2039a4a75d3daa2a58ae5c0b58d3b8d49d77fdcd58fabef177c8a67cf249fc970b823f43558ff3f650845278d906b47317734d5552

    • SSDEEP

      24576:VfOyEXMJKJqR1lIRs2/rsZdFjyiUP29ThVfcyNK+orqtP/O1:VGFMJT6RXwZDjNUYfcg95/O1

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks