Behavioral task
behavioral1
Sample
2232-3-0x0000000000400000-0x0000000000494000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2232-3-0x0000000000400000-0x0000000000494000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2232-3-0x0000000000400000-0x0000000000494000-memory.dmp
-
Size
592KB
-
MD5
b5f14d7420a2188d3c26a10464372b60
-
SHA1
0356dde0e16dc52373fe1d0842bfac35d9739649
-
SHA256
55188b732885e300ba1320c33c28f08af70db77a3987f07213c6d5eb63ef22a1
-
SHA512
b4b5def47ddf1fbdb464b18e8ad87428e049b442cfc849a76b293d018e76f748ab767babe049bf8ab77448b48aad05fd988222397585a639c64af2cc08c8ade2
-
SSDEEP
12288:Z0s7st8ZDw2rXUQsq8BuPTyTc2gPnlrKbx03K4vqw:xJCdTc7nlrKbx03Kvw
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.3
5.42.65.115
Signatures
-
Gcleaner family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2232-3-0x0000000000400000-0x0000000000494000-memory.dmp
Files
-
2232-3-0x0000000000400000-0x0000000000494000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ