Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d46f2ca70bedf6a91b96aa7156346953e0eca16d1f0fa6a1d0761c7ec6232ac1

  • Size

    296KB

  • Sample

    240621-yxtt7s1bng

  • MD5

    de09d3fc3184201fdfaa9293dfcddb3d

  • SHA1

    169f2b3edc5e8f728f9922d1f12e8b7451f1677d

  • SHA256

    d46f2ca70bedf6a91b96aa7156346953e0eca16d1f0fa6a1d0761c7ec6232ac1

  • SHA512

    e9f40d1a96477027667587946ec7d2c88badfb5d30354f9dd18d7436737e1083b0e2bcd789c0e01c5c99bec9b7fd5188eca0cd3ce469eb5acf8300b3d1c58764

  • SSDEEP

    6144:zOcIvBQfhPEbt9ysSzNt88mnOn+Edx5ynVUF23M:zOcIvBQpsbuPTpmY+E75g3

Score
10/10
gcleanerloader

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

    • Target

      d46f2ca70bedf6a91b96aa7156346953e0eca16d1f0fa6a1d0761c7ec6232ac1

    • Size

      296KB

    • MD5

      de09d3fc3184201fdfaa9293dfcddb3d

    • SHA1

      169f2b3edc5e8f728f9922d1f12e8b7451f1677d

    • SHA256

      d46f2ca70bedf6a91b96aa7156346953e0eca16d1f0fa6a1d0761c7ec6232ac1

    • SHA512

      e9f40d1a96477027667587946ec7d2c88badfb5d30354f9dd18d7436737e1083b0e2bcd789c0e01c5c99bec9b7fd5188eca0cd3ce469eb5acf8300b3d1c58764

    • SSDEEP

      6144:zOcIvBQfhPEbt9ysSzNt88mnOn+Edx5ynVUF23M:zOcIvBQpsbuPTpmY+E75g3

    Score
    10/10
    gcleanerloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks