General

  • Target

    4749fcb19cc49a0cd2951f224aced3ba.exe

  • Size

    290KB

  • Sample

    240830-hwhgsatamr

  • MD5

    4749fcb19cc49a0cd2951f224aced3ba

  • SHA1

    78fb5ea85621038ff5a1199e50827ea10495fc26

  • SHA256

    21feed85dcffec9c7a76343729beecd6a53ffe854d972af207edddf154da1814

  • SHA512

    cb3586860d1bfd6d04f128b72fadb81fd8d1d0777dc5f34d82ebf07114b346e279b2440cf4a234f639d59f21d662ba540c4cb338e755d2f2608fa53dd53ceab9

  • SSDEEP

    6144:B5VJAYamjKjoTMFhs52uIls7MhOb625TD2W:B5VJAzd8/cVs3

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

Targets

    • Target

      4749fcb19cc49a0cd2951f224aced3ba.exe

    • Size

      290KB

    • MD5

      4749fcb19cc49a0cd2951f224aced3ba

    • SHA1

      78fb5ea85621038ff5a1199e50827ea10495fc26

    • SHA256

      21feed85dcffec9c7a76343729beecd6a53ffe854d972af207edddf154da1814

    • SHA512

      cb3586860d1bfd6d04f128b72fadb81fd8d1d0777dc5f34d82ebf07114b346e279b2440cf4a234f639d59f21d662ba540c4cb338e755d2f2608fa53dd53ceab9

    • SSDEEP

      6144:B5VJAYamjKjoTMFhs52uIls7MhOb625TD2W:B5VJAzd8/cVs3

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks