gcleaner | a5d14ef9c1b689c9b7a9c5130eb7c148be1266411c2d0fa837073b445ff30737 | Triage

Submit
Reports

Overview

overview

Static

static

3

e520d01e18...18.exe

windows7-x64

e520d01e18...18.exe

windows10-2004-x64

Sharing

General

Target

e520d01e184e7af449548149e8f41548_JaffaCakes118
Size

358KB
Sample

240916-tmaalawhpd
MD5

e520d01e184e7af449548149e8f41548
SHA1

1450af3099391ae76e78e2546b1a5e01058c28bd
SHA256

a5d14ef9c1b689c9b7a9c5130eb7c148be1266411c2d0fa837073b445ff30737
SHA512

1c1b241ec93f1f923e92b7747cf518b66c81bc7473acb9d46dcbe08a952d9374485a1aa38df0a303be7540ba88f13202954f805b490b88b074f4089f0894f0cc
SSDEEP

6144:SR+KxfBgGjFJ5t/qxVSmWKr8H/qZ7GG0hNT1U/cl98wugh:SRLJJpJK9Ai8GITTfzh

Score

10^/10

gcleaner discovery loader

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e520d01e184e7af449548149e8f41548_JaffaCakes118.exe

Resource

win7-20240903-en

gcleaner discovery loader

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

e520d01e184e7af449548149e8f41548_JaffaCakes118.exe

Resource

win10v2004-20240802-en

gcleaner discovery loader

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  e520d01e184e7af449548149e8f41548_JaffaCakes118
- Size
  
  358KB
- MD5
  
  e520d01e184e7af449548149e8f41548
- SHA1
  
  1450af3099391ae76e78e2546b1a5e01058c28bd
- SHA256
  
  a5d14ef9c1b689c9b7a9c5130eb7c148be1266411c2d0fa837073b445ff30737
- SHA512
  
  1c1b241ec93f1f923e92b7747cf518b66c81bc7473acb9d46dcbe08a952d9374485a1aa38df0a303be7540ba88f13202954f805b490b88b074f4089f0894f0cc
- SSDEEP
  
  6144:SR+KxfBgGjFJ5t/qxVSmWKr8H/qZ7GG0hNT1U/cl98wugh:SRLJJpJK9Ai8GITTfzh
Score

10^/10

gcleaner discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

gcleanerdiscoveryloader

behavioral2

gcleanerdiscoveryloader

© 2018-2025

Terms | Privacy