gcleaner | f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660 | Triage

Sharing

General

Target

f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660
Size

248KB
Sample

240521-k7wjwsfh64
MD5

8f06bde9da3b1d959c39a6a5de808583
SHA1

d1cb7e1363ec4047c000d9483bd720bf1f7fa4eb
SHA256

f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660
SHA512

6c924b66a3eca2dd540e91d6e3f8a8322772e9e8146b155d69697028b3d5ec85fa3819d234c45ed15a0f1634dc99189a6aae36075ba61894738bbffde7ae2d72
SSDEEP

3072:ikLBAsY+IEkN7prykneGsjFvoIlv1kreKpiyJB7g2TfDqBV/36e5g:iK2sYbDr9TMv3lereKRJ9bHqXiJ

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660
- Size
  
  248KB
- MD5
  
  8f06bde9da3b1d959c39a6a5de808583
- SHA1
  
  d1cb7e1363ec4047c000d9483bd720bf1f7fa4eb
- SHA256
  
  f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660
- SHA512
  
  6c924b66a3eca2dd540e91d6e3f8a8322772e9e8146b155d69697028b3d5ec85fa3819d234c45ed15a0f1634dc99189a6aae36075ba61894738bbffde7ae2d72
- SSDEEP
  
  3072:ikLBAsY+IEkN7prykneGsjFvoIlv1kreKpiyJB7g2TfDqBV/36e5g:iK2sYbDr9TMv3lereKRJ9bHqXiJ
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2