Extracted

• • Target

    f881f3ca74a2f3a25fbbb77a8208296c5bb0e9305c22752235234ef5f71e324f

  • Size

    304KB

  • MD5

    51b7a152276e9e1d566806f7cc17be50

  • SHA1

    b1e3f432d366934bc04597aef790b56643119e70

  • SHA256

    f881f3ca74a2f3a25fbbb77a8208296c5bb0e9305c22752235234ef5f71e324f

  • SHA512

    481d609659204335894bc8428c9b219979873237d794fe60337f6f6f2f22539bfc8081ef174599a8c94d3e472e547e62201345713b4b303f6664aa2c9108940a

  • SSDEEP

    6144:bBgQgpT8TUdS4BdnP716ChFA8kRSvZdSCXgqU:9gQgXdS4DP788FWRSvZdS

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2