Overview

overview

10

Static

static

3

425b312c60...a8.exe

windows7-x64

10

425b312c60...a8.exe

windows10-1703-x64

10

425b312c60...a8.exe

windows10-2004-x64

10

425b312c60...a8.exe

windows11-21h2-x64

10

Resubmissions

07-01-2024 18:07

240107-wqjpjscef5 10

15-01-2022 08:34

220115-kgnrcsdggm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    425b312c607eaa405059b4928a65cba8.exe

  • Size

    420KB

  • Sample

    240107-wqjpjscef5

  • MD5

    425b312c607eaa405059b4928a65cba8

  • SHA1

    3caefbcad6d742e8c1849ec2d8ce092c0c75152f

  • SHA256

    ea25dcf8f74b1d1094825d695807839f48230a800420cd2c57a05f7f6fe5a5bb

  • SHA512

    89d9c201da31815db48bbb0fea5268044a412dac91677f8d9fc9a7ff1b9eec9d0c8b3c864b340148a22cacbd6b2e3a37dbfd94170ccba3d059ee261c402d1fa6

  • SSDEEP

    12288:hET5GSUENyq2QSfyrVVM6O83C1+ZOXzh:aTXUENRFlZVMusYOj

Score
10/10
gcleaneronlyloggerloader

Malware Config

Extracted

Family

gcleaner

C2

web-stat.biz

privatevolume.bi

Targets

    • Target

      425b312c607eaa405059b4928a65cba8.exe

    • Size

      420KB

    • MD5

      425b312c607eaa405059b4928a65cba8

    • SHA1

      3caefbcad6d742e8c1849ec2d8ce092c0c75152f

    • SHA256

      ea25dcf8f74b1d1094825d695807839f48230a800420cd2c57a05f7f6fe5a5bb

    • SHA512

      89d9c201da31815db48bbb0fea5268044a412dac91677f8d9fc9a7ff1b9eec9d0c8b3c864b340148a22cacbd6b2e3a37dbfd94170ccba3d059ee261c402d1fa6

    • SSDEEP

      12288:hET5GSUENyq2QSfyrVVM6O83C1+ZOXzh:aTXUENRFlZVMusYOj

    Score
    10/10
    gcleaneronlyloggerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

      loaderonlylogger

    • OnlyLogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks