Overview

overview

10

Static

static

3

3eb76d6ba4...c5.exe

windows7-x64

10

3eb76d6ba4...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3eb76d6ba4da9317d14ba30e738fd31f6233399c945c17b3432da26bda2d2bc5

  • Size

    298KB

  • Sample

    240621-pwdl6azeje

  • MD5

    7a5b4d1acfcf7254b548d7c398677bec

  • SHA1

    f58bd58bce8c106c3f0e23fac7f1bbdb390004ed

  • SHA256

    3eb76d6ba4da9317d14ba30e738fd31f6233399c945c17b3432da26bda2d2bc5

  • SHA512

    e605c274c445d7ab331fe1d05d8db26c7fe8d007dd0a02dd95e73c17233f7282fb61871eff2c0e6d5a4863ac0f2f2ac6eaf5e716884d04c524750cf60ed64707

  • SSDEEP

    6144:FDwkbztVn3FIqgMVAfuO/Typ80VXiQX/:F8kbztrAJO7zv

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

185.172.128.69
Attributes
  • url_path

    /advdlc.php

Targets

    • Target

      3eb76d6ba4da9317d14ba30e738fd31f6233399c945c17b3432da26bda2d2bc5

    • Size

      298KB

    • MD5

      7a5b4d1acfcf7254b548d7c398677bec

    • SHA1

      f58bd58bce8c106c3f0e23fac7f1bbdb390004ed

    • SHA256

      3eb76d6ba4da9317d14ba30e738fd31f6233399c945c17b3432da26bda2d2bc5

    • SHA512

      e605c274c445d7ab331fe1d05d8db26c7fe8d007dd0a02dd95e73c17233f7282fb61871eff2c0e6d5a4863ac0f2f2ac6eaf5e716884d04c524750cf60ed64707

    • SSDEEP

      6144:FDwkbztVn3FIqgMVAfuO/Typ80VXiQX/:F8kbztrAJO7zv

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks