gcleaner | ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9
Size

388KB
Sample

240530-v9qrjafb7s
MD5

6c41fca21045431e33fca1d5107beae6
SHA1

6e20891c5fbe1148f8d85e2b6ea2be31dee36bf5
SHA256

ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9
SHA512

794258cbafddafc04be75be6d304ef2ae9dd56b70761d2b96fddf0550a2d0dccde3243d5c8db4448ec40ef46a89761fd2c72c3e7f97c606665173513ad29083c
SSDEEP

6144:djr9eltSqItUozTxEIknA6nqA6raILBSNWG6RXndF:1r9eltDITK4AR2S4ln

Score

10^/10

gcleaner loader

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe

Resource

win10v2004-20240508-en

gcleaner loader

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe

Resource

win11-20240508-en

gcleaner loader

windows11-21h2-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9
- Size
  
  388KB
- MD5
  
  6c41fca21045431e33fca1d5107beae6
- SHA1
  
  6e20891c5fbe1148f8d85e2b6ea2be31dee36bf5
- SHA256
  
  ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9
- SHA512
  
  794258cbafddafc04be75be6d304ef2ae9dd56b70761d2b96fddf0550a2d0dccde3243d5c8db4448ec40ef46a89761fd2c72c3e7f97c606665173513ad29083c
- SSDEEP
  
  6144:djr9eltSqItUozTxEIknA6nqA6raILBSNWG6RXndF:1r9eltDITK4AR2S4ln
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.