gcleaner | 3eef1d0d547de1d8edc9fb20663eb34805778d87eda3c14a56256528f6d5f743 | Triage

Sharing

General

Target

3eef1d0d547de1d8edc9fb20663eb34805778d87eda3c14a56256528f6d5f743
Size

369KB
Sample

240528-hrbtfabc75
MD5

ed509c4893a3ad5607d043113a9006e9
SHA1

eb7b8e9c58eecb331dc6c4bf60528f7b861fa219
SHA256

3eef1d0d547de1d8edc9fb20663eb34805778d87eda3c14a56256528f6d5f743
SHA512

d9dee655f0b9de69c6add3332136bd8803d3329fca04c7dc15e7156ceb15f11171591bd4e3c253dcbb07dfb659f162c4f3d7133f850655c9658379cb1bfc45fa
SSDEEP

6144:oZeJE+fnF9nqZ2NW0+t94siAoU5lePGZBuAXz7LTlcM:oZeDfnF9qZ2NpGVidUO6nXVcM

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  3eef1d0d547de1d8edc9fb20663eb34805778d87eda3c14a56256528f6d5f743
- Size
  
  369KB
- MD5
  
  ed509c4893a3ad5607d043113a9006e9
- SHA1
  
  eb7b8e9c58eecb331dc6c4bf60528f7b861fa219
- SHA256
  
  3eef1d0d547de1d8edc9fb20663eb34805778d87eda3c14a56256528f6d5f743
- SHA512
  
  d9dee655f0b9de69c6add3332136bd8803d3329fca04c7dc15e7156ceb15f11171591bd4e3c253dcbb07dfb659f162c4f3d7133f850655c9658379cb1bfc45fa
- SSDEEP
  
  6144:oZeJE+fnF9nqZ2NW0+t94siAoU5lePGZBuAXz7LTlcM:oZeDfnF9qZ2NpGVidUO6nXVcM
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2