Extracted

• • Target

    70ad12de5123146f1fae3dde193802a51f7e5b3f7bc9a39d97f941e50e06ac53

  • Size

    311KB

  • MD5

    252636d2c1f05c36678e1fdb4704a487

  • SHA1

    fcbb8c213ad4c71f1544df7cdbcc453c5439d156

  • SHA256

    70ad12de5123146f1fae3dde193802a51f7e5b3f7bc9a39d97f941e50e06ac53

  • SHA512

    c7f6ea459ce8efbdb8ebc36301e457fdfaa7e5596b5f91ef0be555d80c5a4f2d7a2f4a12948c3a3a95d8b22763972e1cc5e009cc1e91fbb2ec1329cfb2b3629a

  • SSDEEP

    6144:se0EPXOpVg4NSfJUv67eyjSYUkjWyProIOgx70:sXEPXODn8uv67wkWyProId

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2