Extracted

• • Target

    639b2741f024e5d2f78170b472c90762680feaebf2473e24e0bf49b54297c25b

  • Size

    299KB

  • MD5

    929e1c4d7de071ef5aeb9fd2b2e7813e

  • SHA1

    41e4b840c194823726fef12ea987f8d1a8d7591b

  • SHA256

    639b2741f024e5d2f78170b472c90762680feaebf2473e24e0bf49b54297c25b

  • SHA512

    84c5c1fbb03f64683b48f6e0de9fed851b45f2a9a95ea7149c02b3ba5f7ac7ac6be707c708ff3c473dc125e5588c95ab96bd088c22c487af2681d2e0d75eedcf

  • SSDEEP

    6144:XfH/KjXTSNEfLd7zGHdNXc8w82puOjYZ:PH/KjjSNENzeNXz8pu0Y

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2