gcleaner | 63f109dcc782e8527edd89c34ed90bf5285e97a5cc2935db607e9c1d9af875e1 | Triage

Sharing

General

Target

63f109dcc782e8527edd89c34ed90bf5285e97a5cc2935db607e9c1d9af875e1
Size

378KB
Sample

240419-2tbe8shf53
MD5

92acf86d3ab3508371b8bb3488fd9446
SHA1

26aa1de7f08bbe7b693b808e66f9d508885699fc
SHA256

63f109dcc782e8527edd89c34ed90bf5285e97a5cc2935db607e9c1d9af875e1
SHA512

aafe459864de15712c000ec4655469a49049c0013958324afbbd005444310b4842bdfe1d1ed1114b39019e3a6b008235cdbc8cc843058dc2f19d2e3e6cb3d7cc
SSDEEP

6144:Feioqok9gQZDQmzLg7V3dOeXcIbyz2QbGx0q:FeioqrgQZDQcLg7VNOeXdu6sGx0q

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64

Attributes

url_path
/advdlc.php

Targets

- Target
  
  63f109dcc782e8527edd89c34ed90bf5285e97a5cc2935db607e9c1d9af875e1
- Size
  
  378KB
- MD5
  
  92acf86d3ab3508371b8bb3488fd9446
- SHA1
  
  26aa1de7f08bbe7b693b808e66f9d508885699fc
- SHA256
  
  63f109dcc782e8527edd89c34ed90bf5285e97a5cc2935db607e9c1d9af875e1
- SHA512
  
  aafe459864de15712c000ec4655469a49049c0013958324afbbd005444310b4842bdfe1d1ed1114b39019e3a6b008235cdbc8cc843058dc2f19d2e3e6cb3d7cc
- SSDEEP
  
  6144:Feioqok9gQZDQmzLg7V3dOeXcIbyz2QbGx0q:FeioqrgQZDQcLg7VNOeXdu6sGx0q
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2