gcleaner | b8220b6b3c69724d77fea12ee6f987d333d2d9f261d597ad1c1c87ff0a745a2b | Triage

Sharing

General

Target

b8220b6b3c69724d77fea12ee6f987d333d2d9f261d597ad1c1c87ff0a745a2b
Size

255KB
Sample

240520-h8bvrsab5x
MD5

27339e5285ba492cb8848efb30811d81
SHA1

d62d0edb3061889e2862e0bc28ffff887ade804c
SHA256

b8220b6b3c69724d77fea12ee6f987d333d2d9f261d597ad1c1c87ff0a745a2b
SHA512

3fd8db3d565af495b60bab686f7cb8388fca3333afc7c3d41c8e73fab2bb86a23907db5aaab47c7acf272a5723688f439048fed4a2c4b7ac3dc7d7fa09ff2c71
SSDEEP

3072:3lpJW4MPWXTkKcOj+nnSlu+dODF4yTUYohyRQCu+pxjt+f/wtIxAW27yPBIZ40UE:19Tk7F7T+hovjte/wtIxA6ZIZ40

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.65.64

Attributes

url_path
/advdlc.php

Targets

- Target
  
  b8220b6b3c69724d77fea12ee6f987d333d2d9f261d597ad1c1c87ff0a745a2b
- Size
  
  255KB
- MD5
  
  27339e5285ba492cb8848efb30811d81
- SHA1
  
  d62d0edb3061889e2862e0bc28ffff887ade804c
- SHA256
  
  b8220b6b3c69724d77fea12ee6f987d333d2d9f261d597ad1c1c87ff0a745a2b
- SHA512
  
  3fd8db3d565af495b60bab686f7cb8388fca3333afc7c3d41c8e73fab2bb86a23907db5aaab47c7acf272a5723688f439048fed4a2c4b7ac3dc7d7fa09ff2c71
- SSDEEP
  
  3072:3lpJW4MPWXTkKcOj+nnSlu+dODF4yTUYohyRQCu+pxjt+f/wtIxAW27yPBIZ40UE:19Tk7F7T+hovjte/wtIxA6ZIZ40
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2