General

  • Target

    5932438d564a576e7422056150530700N.exe

  • Size

    257KB

  • Sample

    240903-ggte3aydlp

  • MD5

    5932438d564a576e7422056150530700

  • SHA1

    c141182f2a0ac354814ad70d9e4cc97fd68473a2

  • SHA256

    4edce68e3a00bd0c2e6e466e7f1be27e8b45b4c0001684b4f3f8b725b2828024

  • SHA512

    07ecc3db60c184d498e653af51302e60f9e518ac8e6703203e721018a0e5a5ad3c7140a048b3f1d16aa43ec9d94e37843a3625c44d3ff0184531d0b7231f15cb

  • SSDEEP

    6144:v4XERTEEiPeqnMZYUVY0nJ6R77Mh/zrJ3D2W:vMERIBP5MZYUVYGJ6R7cfJz

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

Targets

    • Target

      5932438d564a576e7422056150530700N.exe

    • Size

      257KB

    • MD5

      5932438d564a576e7422056150530700

    • SHA1

      c141182f2a0ac354814ad70d9e4cc97fd68473a2

    • SHA256

      4edce68e3a00bd0c2e6e466e7f1be27e8b45b4c0001684b4f3f8b725b2828024

    • SHA512

      07ecc3db60c184d498e653af51302e60f9e518ac8e6703203e721018a0e5a5ad3c7140a048b3f1d16aa43ec9d94e37843a3625c44d3ff0184531d0b7231f15cb

    • SSDEEP

      6144:v4XERTEEiPeqnMZYUVY0nJ6R77Mh/zrJ3D2W:vMERIBP5MZYUVYGJ6R7cfJz

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

MITRE ATT&CK Enterprise v15

Tasks