Overview

overview

10

Static

static

3

0171042d64...cs.exe

windows7-x64

10

0171042d64...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe

  • Size

    276KB

  • Sample

    240521-xrchasfb53

  • MD5

    0171042d64375e892b00e341e6319d20

  • SHA1

    7775c4bc882ebb3a815b080159a869d1ffad0005

  • SHA256

    d4f8052c60cbcbe7eae1488b49217fcface8791da3d0c21d1c3228ae9789a83f

  • SHA512

    809117b221603e221df805914a69fabe748cf87c0a164b60a8ce9a16a0d15c9ad1bde57388d9433cb8de9ce4d31e86bdf871526129e4685e16f39ca761df54cb

  • SSDEEP

    6144:uHsVYT6bJzP8yjtm34v+7eOXlS5IVvgAN:gMYWbdBj5v+7h+IVr

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

    • Target

      0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe

    • Size

      276KB

    • MD5

      0171042d64375e892b00e341e6319d20

    • SHA1

      7775c4bc882ebb3a815b080159a869d1ffad0005

    • SHA256

      d4f8052c60cbcbe7eae1488b49217fcface8791da3d0c21d1c3228ae9789a83f

    • SHA512

      809117b221603e221df805914a69fabe748cf87c0a164b60a8ce9a16a0d15c9ad1bde57388d9433cb8de9ce4d31e86bdf871526129e4685e16f39ca761df54cb

    • SSDEEP

      6144:uHsVYT6bJzP8yjtm34v+7eOXlS5IVvgAN:gMYWbdBj5v+7h+IVr

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks