Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec25ce3c66542073ac5da4ac1ad45ea2786b1f67e4708b4cba95a00b0352e659

  • Size

    296KB

  • Sample

    240621-ylfs7svbnj

  • MD5

    333d4cf33552d2874248704b573fab3e

  • SHA1

    dc6a076ae98abd94f4daab61bcad310653c8e01d

  • SHA256

    ec25ce3c66542073ac5da4ac1ad45ea2786b1f67e4708b4cba95a00b0352e659

  • SHA512

    7cd17b62442d15187ac722427c23774a97e7b152df32caa6d9cd6059b0e4c4a5c3976a75db23f7a239493a4d9b1f7e2dc07ba8801fe39426a320eb270f913204

  • SSDEEP

    6144:3GcyoESFMk/57SFvW9ASMs6BrpKS7xKEPBXyVUF23M:3GcPESFpRP9MBrA6xKmXU3

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

    • Target

      ec25ce3c66542073ac5da4ac1ad45ea2786b1f67e4708b4cba95a00b0352e659

    • Size

      296KB

    • MD5

      333d4cf33552d2874248704b573fab3e

    • SHA1

      dc6a076ae98abd94f4daab61bcad310653c8e01d

    • SHA256

      ec25ce3c66542073ac5da4ac1ad45ea2786b1f67e4708b4cba95a00b0352e659

    • SHA512

      7cd17b62442d15187ac722427c23774a97e7b152df32caa6d9cd6059b0e4c4a5c3976a75db23f7a239493a4d9b1f7e2dc07ba8801fe39426a320eb270f913204

    • SSDEEP

      6144:3GcyoESFMk/57SFvW9ASMs6BrpKS7xKEPBXyVUF23M:3GcPESFpRP9MBrA6xKmXU3

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks