gcleaner | ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 00:29

Target

ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577.exe
Size

1.6MB
MD5

2e51a603625cdb8d2aa1634487d58c06
SHA1

956258deffe1ea79ab7b53abca183e9e54c646f1
SHA256

ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577
SHA512

3fab9ca38ed32a2215bbd10c330123019a4e5727c65ac978b0181c41a4c9d058602f57e17eb7a303737136a641e6e7590817d648a19ef9835bb4609a89bde35b
SSDEEP

24576:QXYS1lfPlTqjaLZpgozbAc6a8WeRQpsr9R6fHCe:QoqV9TqjaLZpR2/RC/Ce

Score

10^/10

gcleaner loader

Family

gcleaner

85.208.136.148

85.208.136.56

85.208.136.48

85.208.136.87

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577.exe

pid process

2528 ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577.exe

pid	process
2528	ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577.exe

C:\Users\Admin\AppData\Local\Temp\ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577.exe
"C:\Users\Admin\AppData\Local\Temp\ecc08ddf2b1aba203b7b78161b5e28ecddb999b7848b94bcfc4dc8af7aab8577.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2528

memory/2528-0-0x0000000000400000-0x000000000138E000-memory.dmp

Filesize
15.6MB

Download
memory/2528-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2528-1-0x0000000000400000-0x000000000138E000-memory.dmp

Filesize
15.6MB

Download
memory/2528-3-0x0000000000400000-0x000000000138E000-memory.dmp

Filesize
15.6MB

Download
memory/2528-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download