gcleaner | 809be2acfc886000525a2b030087fd639c8fd8bed9a79a9b458290df87460ba2 | Triage

Sharing

General

Target

809be2acfc886000525a2b030087fd639c8fd8bed9a79a9b458290df87460ba2
Size

390KB
Sample

240609-n7qkesba49
MD5

12137f44edffc0b8c9bdb33392273e2d
SHA1

e8b17496818f79a3b04b96120f276b43b3c69eb4
SHA256

809be2acfc886000525a2b030087fd639c8fd8bed9a79a9b458290df87460ba2
SHA512

610b7b9406b4220805a511461c2c90d99597240d50a8ef41d1082c243e6e5c99434ead930b1a061c4f4d98b39e920963484109aac3b60c5b06b56592b9bfa011
SSDEEP

6144:5cuLtYSM2sgJ5ECWMm6XJSPAhuts85AMHBGFDQA9S:9BYV2JrEs1APAMts8iMhGFA

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  809be2acfc886000525a2b030087fd639c8fd8bed9a79a9b458290df87460ba2
- Size
  
  390KB
- MD5
  
  12137f44edffc0b8c9bdb33392273e2d
- SHA1
  
  e8b17496818f79a3b04b96120f276b43b3c69eb4
- SHA256
  
  809be2acfc886000525a2b030087fd639c8fd8bed9a79a9b458290df87460ba2
- SHA512
  
  610b7b9406b4220805a511461c2c90d99597240d50a8ef41d1082c243e6e5c99434ead930b1a061c4f4d98b39e920963484109aac3b60c5b06b56592b9bfa011
- SSDEEP
  
  6144:5cuLtYSM2sgJ5ECWMm6XJSPAhuts85AMHBGFDQA9S:9BYV2JrEs1APAMts8iMhGFA
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2