General

  • Target

    file.exe

  • Size

    1.1MB

  • Sample

    230703-wdz6rsah2s

  • MD5

    279e8dc20ac913d57b2e99771cdde6ca

  • SHA1

    557f8022da89abb1f0840f9b54d58dc5ea2af2ac

  • SHA256

    0b483c72cef8742a17a84ae3c0bcebf5a00f0e5cfd98ff5c608cf382fcc9ad19

  • SHA512

    c74be65927df292e1c2c14cbc4cf7abc13b67b127186cf46d219205fedc8612648ca4d1279605bace451d2026f582060de4a09568a0e910c86eada61cdd9b79d

  • SSDEEP

    24576:VfOy9p4HXSD6iuibdd/yjQkrlUlUNMUTLYtP/O1:VG0SXM5uKSjQ/lUVc5/O1

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      file.exe

    • Size

      1.1MB

    • MD5

      279e8dc20ac913d57b2e99771cdde6ca

    • SHA1

      557f8022da89abb1f0840f9b54d58dc5ea2af2ac

    • SHA256

      0b483c72cef8742a17a84ae3c0bcebf5a00f0e5cfd98ff5c608cf382fcc9ad19

    • SHA512

      c74be65927df292e1c2c14cbc4cf7abc13b67b127186cf46d219205fedc8612648ca4d1279605bace451d2026f582060de4a09568a0e910c86eada61cdd9b79d

    • SSDEEP

      24576:VfOy9p4HXSD6iuibdd/yjQkrlUlUNMUTLYtP/O1:VG0SXM5uKSjQ/lUVc5/O1

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks