Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    408919a4170d80bc431ba9f08f1409e6f4eb15630cf6934e3924eb057f5332df

  • Size

    424KB

  • Sample

    240905-h9y2pawfqe

  • MD5

    6ad146295efd55b866c27e296621835d

  • SHA1

    8da71a335b1b6530d179ff85660badd525f6063e

  • SHA256

    408919a4170d80bc431ba9f08f1409e6f4eb15630cf6934e3924eb057f5332df

  • SHA512

    5fb9994157738679aa7b110f218e2e253857b53aff2dae7fc28f51bac49d0f404274260006fe15107deb602f2a1c53637b5e5ed34cbb3216e1a3ba2833c01b97

  • SSDEEP

    6144:7sf/JHOjfbLlSozffo+ANlfjVYWUPoQ+uhxfVhdnYx3JTV1E8X2+OkXwA:7UJHOjfbLlSKAFWAQ+G5dKrCpk

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

45.91.200.135

Targets

    • Target

      408919a4170d80bc431ba9f08f1409e6f4eb15630cf6934e3924eb057f5332df

    • Size

      424KB

    • MD5

      6ad146295efd55b866c27e296621835d

    • SHA1

      8da71a335b1b6530d179ff85660badd525f6063e

    • SHA256

      408919a4170d80bc431ba9f08f1409e6f4eb15630cf6934e3924eb057f5332df

    • SHA512

      5fb9994157738679aa7b110f218e2e253857b53aff2dae7fc28f51bac49d0f404274260006fe15107deb602f2a1c53637b5e5ed34cbb3216e1a3ba2833c01b97

    • SSDEEP

      6144:7sf/JHOjfbLlSozffo+ANlfjVYWUPoQ+uhxfVhdnYx3JTV1E8X2+OkXwA:7UJHOjfbLlSKAFWAQ+G5dKrCpk

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks