Extracted

• • Target

    da15ad1b5bfc49155d9a2a69e5ad10e006c589fc99e53b3d961fa29673398112

  • Size

    414KB

  • MD5

    3608071108d81d41f3db4b579e77ecb1

  • SHA1

    ec65be0f566a21d5d7fde19764efb40963da19df

  • SHA256

    da15ad1b5bfc49155d9a2a69e5ad10e006c589fc99e53b3d961fa29673398112

  • SHA512

    809da173778dc254e3ee288db52f7eab1c39ad2b563c85665c895ea59abd51cd53bdecb6ac8eb6107c0ca90a7aef89a2012d7ad92fd5e8bb904feed0b0bf49db

  • SSDEEP

    6144:XdqJ2HcuDKtjKgGXPKpPrcfadQQZRP/bC7VF/11XP:XkgHzD0mWTSadQQzbuVvJ

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2