Extracted

• • Target

    82bb3ca37dc71eaa8e41ce63b437b30fb4ca1e5df49837d77b5f8e8ba6f2ba33

  • Size

    324KB

  • MD5

    570ea4bf0c07e1e6ee8e350611aef160

  • SHA1

    59e54afdd82fd18c65854981a738c2d192cda8b6

  • SHA256

    82bb3ca37dc71eaa8e41ce63b437b30fb4ca1e5df49837d77b5f8e8ba6f2ba33

  • SHA512

    2d7b8628944ecba398e5930a374b9256b8b21ca32cb6c59981707f5499b2004904b1c2f09bb79b3a56c5e0e29f452f34728b3224abb5907d527060eb347c02fc

  • SSDEEP

    6144:TfbDrty9JbmIgP6eP+fKtuol4gWeTjqmF/Q:jb/ty9JmV0ml4gJ68/

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2