Extracted

• • Target

    ce7b5416c09c7591e9d65fd4cec9b6ad08e23ec725f3acb007e8a8addf0341ed

  • Size

    324KB

  • MD5

    e758217722d30aa504dca0ca929fb6b8

  • SHA1

    ae125b76c669d03a776df574175b3aef2de14935

  • SHA256

    ce7b5416c09c7591e9d65fd4cec9b6ad08e23ec725f3acb007e8a8addf0341ed

  • SHA512

    29f9e327ef87d18415a2140ce9c325173575f7b934c0ba88c7bcdbd0d44348658dbd1ad91577b8d3fa33ba6f4db88e2248675385e9b5f636ed7e5f22172d2093

  • SSDEEP

    6144:uADahWrg8roVp55fFzaLGJ0qa1ifMofts/MMtx0Vdh1tQ:uYagk8rwp55fF2LGJA13MtAQVdz

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2