Overview

overview

10

Static

static

3

d580cf5c59...87.exe

windows7-x64

10

d580cf5c59...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d580cf5c5974abebad470cf01f14bb9e1fa4d462fdc68774f10f03b6c852d687.exe

  • Size

    368KB

  • Sample

    240615-cpgn1szcjk

  • MD5

    999ce981075f5220da3b60405de5a153

  • SHA1

    3b92e8ebd076991db92be24bfa63dfea05a0c298

  • SHA256

    d580cf5c5974abebad470cf01f14bb9e1fa4d462fdc68774f10f03b6c852d687

  • SHA512

    087dee6d3b52d49e5a42406f8d8d306637cfd3a4c3f984b9be46ccaf8e2a896ea489edeeb75627cd2d6311359824c53265d7f2231e1bce6b4591379fa944bedc

  • SSDEEP

    6144:uw1gc73/WolE+EF6YIczP138yJWt32WLaQF1TGX6BSdTH:Sc7Fg6DEPxf23Fjv6quH

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

    • Target

      d580cf5c5974abebad470cf01f14bb9e1fa4d462fdc68774f10f03b6c852d687.exe

    • Size

      368KB

    • MD5

      999ce981075f5220da3b60405de5a153

    • SHA1

      3b92e8ebd076991db92be24bfa63dfea05a0c298

    • SHA256

      d580cf5c5974abebad470cf01f14bb9e1fa4d462fdc68774f10f03b6c852d687

    • SHA512

      087dee6d3b52d49e5a42406f8d8d306637cfd3a4c3f984b9be46ccaf8e2a896ea489edeeb75627cd2d6311359824c53265d7f2231e1bce6b4591379fa944bedc

    • SSDEEP

      6144:uw1gc73/WolE+EF6YIczP138yJWt32WLaQF1TGX6BSdTH:Sc7Fg6DEPxf23Fjv6quH

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Detects Windows executables referencing non-Windows User-Agents

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks