Extracted

• • Target

    92c512db0f7da8bf28505fb0e9e6580954091dd0758da372167ac4419086a8eb

  • Size

    329KB

  • MD5

    46dd726e42653e27848d9a4a2fc69962

  • SHA1

    9202665b212fe7dd6faa9fae08b51479fad8e689

  • SHA256

    92c512db0f7da8bf28505fb0e9e6580954091dd0758da372167ac4419086a8eb

  • SHA512

    d408c102daa487dad863f6951d8d36e2a00a64bbacb447bbd0c55759327bce72f17dd665479c47f65cc4e3e200c24e1acc738db3b32d3b6b56201e40001cbfb3

  • SSDEEP

    6144:mLLnTFb+p6U9OOcPqSntFpUUxVVAo7sZEFm9/AZEsGXvkE:IbTFa6UkO0LtFpUUTxsZX94WV

  Score

  10^/10

  gcleanerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2