gcleaner | 47ba7c64d177a749d68fe51794e3029da90af2af0e6b40e34526134b3d9a5ed8 | Triage

Sharing

General

Target

47ba7c64d177a749d68fe51794e3029da90af2af0e6b40e34526134b3d9a5ed8
Size

248KB
Sample

240520-e2k83sbf24
MD5

2f6b0c0517ae3931a40bf027e53cd0b2
SHA1

0ef1e10d4f179bc2b749881860adc4888727d2f3
SHA256

47ba7c64d177a749d68fe51794e3029da90af2af0e6b40e34526134b3d9a5ed8
SHA512

19288b48920c83dbf38be9d08a4e516bed494669f596a1ff9e71af9ebdfebf719acf4883ab66e1c0ea73ab46bccab373239482e2dfc2dbf70bb6a413cf0da98c
SSDEEP

3072:L0SCvCj4cwekfilsN2h9LMr9CQznQnTOhj7qmPhDbaxxjuglO/vQ5Q:wS6CjnkfwsMehQn6hj7XeKX/

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  47ba7c64d177a749d68fe51794e3029da90af2af0e6b40e34526134b3d9a5ed8
- Size
  
  248KB
- MD5
  
  2f6b0c0517ae3931a40bf027e53cd0b2
- SHA1
  
  0ef1e10d4f179bc2b749881860adc4888727d2f3
- SHA256
  
  47ba7c64d177a749d68fe51794e3029da90af2af0e6b40e34526134b3d9a5ed8
- SHA512
  
  19288b48920c83dbf38be9d08a4e516bed494669f596a1ff9e71af9ebdfebf719acf4883ab66e1c0ea73ab46bccab373239482e2dfc2dbf70bb6a413cf0da98c
- SSDEEP
  
  3072:L0SCvCj4cwekfilsN2h9LMr9CQznQnTOhj7qmPhDbaxxjuglO/vQ5Q:wS6CjnkfwsMehQn6hj7XeKX/
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2