Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    925e23361f4b053bd6ebefb0ec2df276457f57d43f970ec7ec0b624acfb98a30

  • Size

    330KB

  • Sample

    240527-lql5kagd48

  • MD5

    a8e5c78ce2ba70689aefbbd93fd5963c

  • SHA1

    ed00c384c8d50f04612a0fdbb27e39b0ad7ef739

  • SHA256

    925e23361f4b053bd6ebefb0ec2df276457f57d43f970ec7ec0b624acfb98a30

  • SHA512

    db8a69130264ff2aa2b60b31303eb34f24032154ffd1d9c9a3f03bca8cde916e367c219c00aaf832b3f2f0717fff4a4dd01489d280befba076cb5fa767a00991

  • SSDEEP

    3072:XZOXmv5EYBVtlBIN9STYyOcgK/IONhGQwnA5dcSIUwdDvTGk1Nsg57y8+Co4m:XZOXU5EwlSfS35hGqdRCvqk1N40r

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

    • Target

      925e23361f4b053bd6ebefb0ec2df276457f57d43f970ec7ec0b624acfb98a30

    • Size

      330KB

    • MD5

      a8e5c78ce2ba70689aefbbd93fd5963c

    • SHA1

      ed00c384c8d50f04612a0fdbb27e39b0ad7ef739

    • SHA256

      925e23361f4b053bd6ebefb0ec2df276457f57d43f970ec7ec0b624acfb98a30

    • SHA512

      db8a69130264ff2aa2b60b31303eb34f24032154ffd1d9c9a3f03bca8cde916e367c219c00aaf832b3f2f0717fff4a4dd01489d280befba076cb5fa767a00991

    • SSDEEP

      3072:XZOXmv5EYBVtlBIN9STYyOcgK/IONhGQwnA5dcSIUwdDvTGk1Nsg57y8+Co4m:XZOXU5EwlSfS35hGqdRCvqk1N40r

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks