Extracted

• • Target

    813fbf2c1ab78f09d269895f0b2f8b5248bb049c8f4b3181c8729da0feb56024

  • Size

    299KB

  • MD5

    38a55efd06cfd76ad153eb4e7b173d84

  • SHA1

    450a29c04a5364b6f64937162ef6476935f38159

  • SHA256

    813fbf2c1ab78f09d269895f0b2f8b5248bb049c8f4b3181c8729da0feb56024

  • SHA512

    d1009ed7f6832eacd19a2d2d6efa7c5b275cb33e10eb6bca9df111a360077492ea10151a2eacff8ab029ca914e09d5b7f9b09a7a61d72c164b92ecb3dd054539

  • SSDEEP

    6144:+uDUYxOOoC2iSlvfxcYrfpXb+REK5NgHBElhG4/MBC0Vdh1HQ:+mUHbC2Zlvfxvr+RP56HibYVdz

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2