Extracted

• • Target

    univ.exe

  • Size

    447KB

  • MD5

    877578aa859949f65846c834ce2740a1

  • SHA1

    948c5764c2f4edae98c162cae1fc9839a9f2e1f2

  • SHA256

    dd116354036dca800f4b1be5fde7e338b6d647b468323d3df828a7180e110d96

  • SHA512

    07d1cbbe9b4bb338c961af05d5f6791e8f94d06aff642728a091f059e248e7f4f0e096d1b49c6f4a59ff063246fc61083a2b097132516bcf752d9822dd90335e

  • SSDEEP

    6144:zELuwysoySGLobNl2kVJIkGd6tWqnb0FyggNifGi/1oD5zlW5FXCnFk:zszysoydLobZVJIkGdSwyNMS5hoSC

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2