Extracted

• • Target

    4b8129293d30068cbd4c2064950b12fd28aa7e92486cd4cf41d008e07188bbef

  • Size

    381KB

  • MD5

    74f80e6090693c6a3ac3a2be8c04aa02

  • SHA1

    b2425774cea77b026a2977e4cefd848d50c6d429

  • SHA256

    4b8129293d30068cbd4c2064950b12fd28aa7e92486cd4cf41d008e07188bbef

  • SHA512

    a29921bb21655cb0b827ec219637f051b804cb01d86a82ab759f972e7af19d8bfece1a22ad3370584b6e47e3b64b090e4c0bf68e2b1d65aec32b0449ad8ef8b5

  • SSDEEP

    6144:cB9KsjJYcvN6sg5ZmpSnmknQW4p/mDQtcdMx5S6f:c6yJYcvNifnlnQWacag

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2