gcleaner | 7918db42bdb96b0c9b2aceda1cdc28d98f074f32ea3e53834d4e0b2403bf3b90 | Triage

Sharing

General

Target

7918db42bdb96b0c9b2aceda1cdc28d98f074f32ea3e53834d4e0b2403bf3b90
Size

332KB
Sample

240621-ptpxeazdle
MD5

864d8eb9879f8ab811df82a22683ac74
SHA1

f434f755d8acf1937c60d457882a03829d29662b
SHA256

7918db42bdb96b0c9b2aceda1cdc28d98f074f32ea3e53834d4e0b2403bf3b90
SHA512

b02aa2eea5a3aead2bc1f1dd0c6c4af63927eaeaa0d519e4824571e59121b1bd93bc14eea8b1644cad1e08416a4596295a84ac0b7f4ad2eac9ba04a3d4d58b21
SSDEEP

6144:aAYn+pijVxdVsPpeWBMejKK1jeqcI/Gch5nq9/:nYn+pixxd+heWL1j5cYGenqp

Score

10^/10

gcleaner loader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

- Target
  
  7918db42bdb96b0c9b2aceda1cdc28d98f074f32ea3e53834d4e0b2403bf3b90
- Size
  
  332KB
- MD5
  
  864d8eb9879f8ab811df82a22683ac74
- SHA1
  
  f434f755d8acf1937c60d457882a03829d29662b
- SHA256
  
  7918db42bdb96b0c9b2aceda1cdc28d98f074f32ea3e53834d4e0b2403bf3b90
- SHA512
  
  b02aa2eea5a3aead2bc1f1dd0c6c4af63927eaeaa0d519e4824571e59121b1bd93bc14eea8b1644cad1e08416a4596295a84ac0b7f4ad2eac9ba04a3d4d58b21
- SSDEEP
  
  6144:aAYn+pijVxdVsPpeWBMejKK1jeqcI/Gch5nq9/:nYn+pixxd+heWL1j5cYGenqp
Score

10^/10

gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2