Extracted

• • Target

    gcleaner/0bd8870d0ff1f1896fdc4ba339e7c396438f77bc5b20dd12218e5a33bb19ecc1

  • Size

    229KB

  • MD5

    8dd083b8b1dadae34d62d6c2065ccabf

  • SHA1

    932fbc9b865200d84867f255f06a9d5d8a0e0b64

  • SHA256

    0bd8870d0ff1f1896fdc4ba339e7c396438f77bc5b20dd12218e5a33bb19ecc1

  • SHA512

    077bdea9fe8211da138ebb2007f4e61aa8f5a94973aad5f5158d03f551cd6305d0605e17dac47791a295923306751d5efd1c0438f2d421961ed1e51871e32278

  • SSDEEP

    6144:1ys6cvhe8LVx4gQa+kzJPoxFWaxJDv24ejBvc45OszrUlWNb6wUVRFvVzHl1nNIB:1ys6cpe8LVx4gQa+kzJPoxFWaxJDv24y

  Score

  8^/10

  discovery

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral1behavioral2

• • Target

    gcleaner/47d23a5f7030e01eb703b706b794a485af38eee5c54d8cc1ae85f3e380210c45

  • Size

    234KB

  • MD5

    fee086c65beb28052a7314b45edcba22

  • SHA1

    9eb1c2169b7696ba7370b642896f1bb5c9bde1a5

  • SHA256

    47d23a5f7030e01eb703b706b794a485af38eee5c54d8cc1ae85f3e380210c45

  • SHA512

    2d78f992c9d7698eac51018a02bc39a065acd6a93a77c5ba0580db2b68f3fe9bdf5a7d6adcd91a0852a57fcb39dca0d3b3c4e4f6aa1a89cda0db471346f59275

  • SSDEEP

    6144:Ay9aqZ4NyJlTYc4m0HSWEXZ+ISRmgOXMiHxgzx6H39GieMZ5LZvoBTLvLPDiYcQw:Ay9aqZrJlTYc4m0HSWEXZ+ISRmgOXMib

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    gcleaner/add5991412c9cca081283399fd1929c8cf39df306cea20562f72e47cbc5b50a6

  • Size

    234KB

  • MD5

    31950c4d7a64b9b86cdb5eb1811d16d8

  • SHA1

    1f12fd16574ef08231a9c8b486a1dc21da77276b

  • SHA256

    add5991412c9cca081283399fd1929c8cf39df306cea20562f72e47cbc5b50a6

  • SHA512

    8555b767298f0b13b03be3a7dd8d51d9ece5993f2ed9a5b84c4f31bae53016bc18d30591df98f9004e0aeee43f9de03287189ab9678ad3bce7139c0c4d0e9c7f

  • SSDEEP

    6144:Ay9aqZ4NyJlTYc4m0HSWEXZ+ISRmgOXMiHxgzx6H39GieMZ5LZvoBTLvLPDiYcQa:Ay9aqZrJlTYc4m0HSWEXZ+ISRmgOXMiB

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    gcleaner/df54e84b15071e1f51a157edce5d59035c2b5eaad35cb12d5c4a69cb38c62a32

  • Size

    176KB

  • MD5

    33a7ea85a917b0cf57cddfa8226f4509

  • SHA1

    dc999922a756e40334b39ecdd2d199fe7d596213

  • SHA256

    df54e84b15071e1f51a157edce5d59035c2b5eaad35cb12d5c4a69cb38c62a32

  • SHA512

    6a72cd9b89e35e00db303d48972c6932b05623fb11c288bb30e562da73b131ba376210455b1f8aab913fa2bca1f86785dc2f9fa9ace64c0728132febff7b8aca

  • SSDEEP

    3072:Z5GpcsVZHn+D7ymvFtfII7A1lJJyrGbhCI6kiNqN138OqtOAg0Fuj0NRxyZaD:Z5GpcgJ+DPzIa6brCIbiNGpAOqyZaD

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral7behavioral8

• • Target

    gcleaner/e3752915e9b12609fa22a99275111e4533903ad3af8ca01419562a2871a5c071

  • Size

    234KB

  • MD5

    df84064620e647c9f8ad0f966c1f1576

  • SHA1

    f7427ed939f043601f270eb9c7b8f685328574ae

  • SHA256

    e3752915e9b12609fa22a99275111e4533903ad3af8ca01419562a2871a5c071

  • SHA512

    19d96fcefa6cc9b68319f4eb22b006a9001c27e8467bdf07ec42fde3e1a7f59ecd738994e7ddb87c23b8b7bcd82449590a5fe0df194ffcd4f0cbfa70d35d0dbe

  • SSDEEP

    6144:Ay9aqZ4NyJlTYc4m0HSWEXZ+ISRmgOXMiHxgzx6H39GieMZ5LZvoBTLvLPDiYcQ3:Ay9aqZrJlTYc4m0HSWEXZ+ISRmgOXMiQ

  Score

  8^/10

  discovery

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  behavioral10behavioral9