Extracted

• • Target

    8210a56df3dde9d1eaf5669eca7d25dd436b741e3a1fb63f1e6e2c6bd3181bea

  • Size

    292KB

  • MD5

    f8ea94e5b721fe597d6efd5b301e2491

  • SHA1

    a19bbd544f15d4113d8068ec258ce087391b7d4e

  • SHA256

    8210a56df3dde9d1eaf5669eca7d25dd436b741e3a1fb63f1e6e2c6bd3181bea

  • SHA512

    96f0dd2f73239d51297908e2f0bb8cd6605edfebaad56180ef8cdf7b6d734ed3ba1a60d64656e40207eb45f2d709d4335651121db2dbfda5936af074d3348ee9

  • SSDEEP

    6144:KC5grVywxDnO/nU+qKOXSyZPsl7MhZlDMW:KC5gxxi/nU+qbZycZV

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2