Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0d7801a4e80fd6e0f5c4994aa5070e38c4500e9ed2800b42f01888bf9f5f9529

  • Size

    312KB

  • Sample

    240710-s5rf6aybnc

  • MD5

    51c12bf87151c5ddb493cbbc11f71334

  • SHA1

    227857366945cdd22abec6c15388097b0870de7f

  • SHA256

    0d7801a4e80fd6e0f5c4994aa5070e38c4500e9ed2800b42f01888bf9f5f9529

  • SHA512

    7c8392e0decf981d88e5ee081d6db26130d674fff55e32af35badab620aec4f605946133442c3f5651f58bf1d1c295aaabd7c1de3094827a325e94760a0c9802

  • SSDEEP

    3072:2iDyo7YTZj5I6hcpmd5+wX/yjVANCIYWAt2IfUQlCuvuz7hg:FOoUapmWcKjqNBi7fUQ0Muz

Score
10/10

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

185.172.128.69

Attributes
  • url_path

    /advdlc.php

Targets

    • Target

      0d7801a4e80fd6e0f5c4994aa5070e38c4500e9ed2800b42f01888bf9f5f9529

    • Size

      312KB

    • MD5

      51c12bf87151c5ddb493cbbc11f71334

    • SHA1

      227857366945cdd22abec6c15388097b0870de7f

    • SHA256

      0d7801a4e80fd6e0f5c4994aa5070e38c4500e9ed2800b42f01888bf9f5f9529

    • SHA512

      7c8392e0decf981d88e5ee081d6db26130d674fff55e32af35badab620aec4f605946133442c3f5651f58bf1d1c295aaabd7c1de3094827a325e94760a0c9802

    • SSDEEP

      3072:2iDyo7YTZj5I6hcpmd5+wX/yjVANCIYWAt2IfUQlCuvuz7hg:FOoUapmWcKjqNBi7fUQ0Muz

    Score
    10/10
    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks