Extracted

• • Target

    9d8a43469f68b11821b4b07e7997df3ff3880f5688b818f56595eeccb72d8a76

  • Size

    334KB

  • MD5

    e19a1a74ca269e6ec719d2616481c93b

  • SHA1

    d1017031dcf6177ba2d096f118b16c315f1d194c

  • SHA256

    9d8a43469f68b11821b4b07e7997df3ff3880f5688b818f56595eeccb72d8a76

  • SHA512

    7184fa66742da21a4d7f4202986bb8b287e8f9768c6ae45489ccbd02ab7eae9ceaa6fae40bd9b6debaf2e49b89ca634d850969955ea46aae6988ceed28610a38

  • SSDEEP

    3072:TSJL7ualeNNnSGUgYAjvOTib+ybHIdKAiniGlK5VaRF0HyMPL+d5RQlssAxaxcqc:eL7FoNfLJvMy7IdKTdK5kRIXFel

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2