General

  • Target

    file

  • Size

    1.1MB

  • Sample

    230703-ttfe7aae2w

  • MD5

    26cd5b79dc7206e2db2a4129d34f68a6

  • SHA1

    5780aa7495fe119b5968f8503949e347ce5ed826

  • SHA256

    82f7dcaca644a09432527d65445970bbb6502b866c6daa62013203c55ca7de3a

  • SHA512

    78beebb31b57c879b33214d1c686db950e89309d2046449b4816a240baefb3c396cfc7fe7256075dad36e681c6c4df3b19b95521a572947226e45068895e174b

  • SSDEEP

    24576:VfOyrgDDUXa1FbqsoK8COVKh9VfA0VHeUI5kL6bn2ZDD8KfotP/O1:VG3xbqtK8CJxfAiITn2ZPG5/O1

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file

    • Size

      1.1MB

    • MD5

      26cd5b79dc7206e2db2a4129d34f68a6

    • SHA1

      5780aa7495fe119b5968f8503949e347ce5ed826

    • SHA256

      82f7dcaca644a09432527d65445970bbb6502b866c6daa62013203c55ca7de3a

    • SHA512

      78beebb31b57c879b33214d1c686db950e89309d2046449b4816a240baefb3c396cfc7fe7256075dad36e681c6c4df3b19b95521a572947226e45068895e174b

    • SSDEEP

      24576:VfOyrgDDUXa1FbqsoK8COVKh9VfA0VHeUI5kL6bn2ZDD8KfotP/O1:VG3xbqtK8CJxfAiITn2ZPG5/O1

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks