Extracted

• • Target

    univ.exe

  • Size

    299KB

  • MD5

    e74f77626d857bc78ed253336e06f5f3

  • SHA1

    7857266e43f3d7843c4a70f8817ebd873049f247

  • SHA256

    ac4e985b34d784c983669f7dba6018048d35a156627dade5c1440167d5adc5ca

  • SHA512

    9cd4dd004873a1b0d60bb9692eb2bb6716535dc0bc2db67ed55f56f2a83685c5d2721c1913581ab4ff27f1fd04dfbc1a7dc935c9e593936ca74f53dedaed9167

  • SSDEEP

    6144:2XDogmKcmq3zvmPG0XrWdhb3dLlpgJOX/MN60Vdh1HQ:2TorDmq3zOPzXriTd3rM3Vdz

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2