Overview

overview

10

Static

static

3

37f074e704...38.exe

windows7-x64

10

37f074e704...38.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    67fcce3d5c8e7c4fe18c1180623103bf.bin

  • Size

    1.2MB

  • Sample

    230712-bveaeabe29

  • MD5

    ecc410d9991da98295222261f7763621

  • SHA1

    1430aec4bce59816030509d35a5816d750a45a22

  • SHA256

    2eef83accbe4a49c2bc18c45c56a965df68b67c2de32338152f6a3751a3d3db7

  • SHA512

    52d22bcc08e3d310bf177a51679cfc88099ed0f1ff325990e9ee865fe614fdf61c95136015ad8d1f15c3ea24bc2579cbc6447aadbb8f8ba501dc881d121883ff

  • SSDEEP

    24576:7Kyksjzlk7NXdEva+Km+Y/WgQU2KFDKopy4tiO:3kkzlAz+Ko/PFDDpyiiO

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      37f074e704bbad04527d2f14ed764ecdd6e9520ad244ee92747e6ca7e6229e38.exe

    • Size

      1.2MB

    • MD5

      67fcce3d5c8e7c4fe18c1180623103bf

    • SHA1

      e92e863bcebef447f56d62393f088e70bda7c9a6

    • SHA256

      37f074e704bbad04527d2f14ed764ecdd6e9520ad244ee92747e6ca7e6229e38

    • SHA512

      d1b6f70abb6a9c8c1802ec6eb6076c3807af4c71724dea6960376ed1ad2e8d9512886c81e653118e49edb412bbc353a1c1039e56306a3295a426bcd3d9c56386

    • SSDEEP

      24576:nfOyH3/ld1p409p4gPNDfpD8Lxolkz1DI1YSk2TSPv5dl2vSBreuS2w02VnKU:nGM/Pr4gPh18+lkzdIhk0g5FeuZknn

    Score
    10/10
    gcleanerdiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks