gcleaner | 1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7 | Triage

Sharing

General

Target

1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7
Size

326KB
Sample

240521-rfh8tagf8s
MD5

24d108c845e828d6003114f825874d82
SHA1

d11605c79cfd0b4c75e2cf9906a437c10c34af95
SHA256

1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7
SHA512

ce4dadc5219e309ace067d0bea88f088bb445d585d0f18711108de8b800ca4949bd17d1cc16eb0f8ae3fab689133d2d1b5883b36ae49ac1f2dfc16052806fa2e
SSDEEP

3072:x454O4ar7l36mjhjbgh3bAC6UVQSrXskLjjiOJd5YexBy:x0l93djSh3bACFVQpkdCexB

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

185.172.128.69

Attributes

url_path
/advdlc.php

Targets

- Target
  
  1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7
- Size
  
  326KB
- MD5
  
  24d108c845e828d6003114f825874d82
- SHA1
  
  d11605c79cfd0b4c75e2cf9906a437c10c34af95
- SHA256
  
  1d8d71d53d519ba92d7b6b8258c9633c119680b1c5c3c95a79038a28741589c7
- SHA512
  
  ce4dadc5219e309ace067d0bea88f088bb445d585d0f18711108de8b800ca4949bd17d1cc16eb0f8ae3fab689133d2d1b5883b36ae49ac1f2dfc16052806fa2e
- SSDEEP
  
  3072:x454O4ar7l36mjhjbgh3bAC6UVQSrXskLjjiOJd5YexBy:x0l93djSh3bACFVQpkdCexB
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2