gcleaner | 49d47153327f8caff7b34bd07c2880e166ee9511fbdc4fffe9f818bf56cd174d | Triage

Sharing

General

Target

49d47153327f8caff7b34bd07c2880e166ee9511fbdc4fffe9f818bf56cd174d
Size

413KB
Sample

240608-1gp77agf9x
MD5

a0a33e70f1bccc072f0366f4e801929d
SHA1

cf96303206d23b0991c1e0063fa25983576a6114
SHA256

49d47153327f8caff7b34bd07c2880e166ee9511fbdc4fffe9f818bf56cd174d
SHA512

de3539ae6f99a9684350006abe0b8419778119a71f43af19a336c415eee02f23599ea4f8ef731e24de8b3b9068e08a69b9e754cbffd6f966bc4952640e70f15c
SSDEEP

3072:bpftBLHz0Xpee4Pkri+6yLE1/BxBnBhgsDqVrtCor04YfC/NB6f54GoYJ/koYJ/u:bHBLT0XAIzLwBx7huV5LlNB3G+KS

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  49d47153327f8caff7b34bd07c2880e166ee9511fbdc4fffe9f818bf56cd174d
- Size
  
  413KB
- MD5
  
  a0a33e70f1bccc072f0366f4e801929d
- SHA1
  
  cf96303206d23b0991c1e0063fa25983576a6114
- SHA256
  
  49d47153327f8caff7b34bd07c2880e166ee9511fbdc4fffe9f818bf56cd174d
- SHA512
  
  de3539ae6f99a9684350006abe0b8419778119a71f43af19a336c415eee02f23599ea4f8ef731e24de8b3b9068e08a69b9e754cbffd6f966bc4952640e70f15c
- SSDEEP
  
  3072:bpftBLHz0Xpee4Pkri+6yLE1/BxBnBhgsDqVrtCor04YfC/NB6f54GoYJ/koYJ/u:bHBLT0XAIzLwBx7huV5LlNB3G+KS
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2