gcleaner | f9f4c82e31af92238ea1a7bee391e2bf73381a361270822a2fb6e226d34d3544 | Triage

Sharing

General

Target

f9f4c82e31af92238ea1a7bee391e2bf73381a361270822a2fb6e226d34d3544
Size

344KB
Sample

240528-apylesfe6w
MD5

72422265beaec7caaab1b56946c23c50
SHA1

def66af74c82d0df7796a5a829ee8cc25019e5ea
SHA256

f9f4c82e31af92238ea1a7bee391e2bf73381a361270822a2fb6e226d34d3544
SHA512

219838aba2640770842c68fdc0c76f940521bbaeeae9aff023883b08ae51e6bc31f00e696aaee96b9b807ac1a5908cb2b6e6416d1445004a0cadd15551ed4cee
SSDEEP

3072:2V6nk5rJdThB4QO1p+HGbMN+9PqO90hYMq64nEidRZUscPpbV5CpiJW5ck+/5WZ9:2ckpTs/eHDOd64n1LZqPppsi7wZnUe

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  f9f4c82e31af92238ea1a7bee391e2bf73381a361270822a2fb6e226d34d3544
- Size
  
  344KB
- MD5
  
  72422265beaec7caaab1b56946c23c50
- SHA1
  
  def66af74c82d0df7796a5a829ee8cc25019e5ea
- SHA256
  
  f9f4c82e31af92238ea1a7bee391e2bf73381a361270822a2fb6e226d34d3544
- SHA512
  
  219838aba2640770842c68fdc0c76f940521bbaeeae9aff023883b08ae51e6bc31f00e696aaee96b9b807ac1a5908cb2b6e6416d1445004a0cadd15551ed4cee
- SSDEEP
  
  3072:2V6nk5rJdThB4QO1p+HGbMN+9PqO90hYMq64nEidRZUscPpbV5CpiJW5ck+/5WZ9:2ckpTs/eHDOd64n1LZqPppsi7wZnUe
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2