gcleaner | 722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535 | Triage

Sharing

General

Target

722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535
Size

397KB
Sample

240616-1lcsnatcnl
MD5

069c91aae80b0039be0711657c507e4b
SHA1

2ec41aa6025dd381ff394739a97d91bdc87de3e5
SHA256

722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535
SHA512

d0f7c45c681929c0c282c03bb3807a167f758f9a5d164335b08b69109eb941c986e8e32d210b821d285dba85d6a6151ca461b1c4a71711cf1312ffe84a4e4af1
SSDEEP

6144:fjWL0aERFXqk8F2SgzUlhNtwbS+EuWCE31YLldJ2fve4KHeCVwy57AUV:fiNEzqk8CYlhNgS+EHCE3cGveUm7

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535
- Size
  
  397KB
- MD5
  
  069c91aae80b0039be0711657c507e4b
- SHA1
  
  2ec41aa6025dd381ff394739a97d91bdc87de3e5
- SHA256
  
  722a60e80f5558fd364fb4abbc9265106adb06f52f433aed2508d08c76a4a535
- SHA512
  
  d0f7c45c681929c0c282c03bb3807a167f758f9a5d164335b08b69109eb941c986e8e32d210b821d285dba85d6a6151ca461b1c4a71711cf1312ffe84a4e4af1
- SSDEEP
  
  6144:fjWL0aERFXqk8F2SgzUlhNtwbS+EuWCE31YLldJ2fve4KHeCVwy57AUV:fiNEzqk8CYlhNgS+EHCE3cGveUm7
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2