gcleaner | 9360f1b394216dde2d02525c02f8118ebc0a047a810838e848b01df5dffd6cfc | Triage

Submit
Reports

Overview

overview

Static

static

3

9360f1b394...fc.exe

windows7-x64

9360f1b394...fc.exe

windows10-2004-x64

Sharing

General

Target

9360f1b394216dde2d02525c02f8118ebc0a047a810838e848b01df5dffd6cfc
Size

421KB
Sample

241109-tj2wfaxfrq
MD5

1a0fe993e2a9709c41e3388a9ad284c1
SHA1

9c233e8cacca30e291184a4eff341d453648e42d
SHA256

9360f1b394216dde2d02525c02f8118ebc0a047a810838e848b01df5dffd6cfc
SHA512

fbcbad5aac33edc82cba79d806939af7c5ea3ad8c43b4333725e56fa160093d885e8ba61e55907d7c37205f11a6ea489ec4b4ff4d45321868c1f4f3f2e16179d
SSDEEP

6144:ROWzR3+a9XKBBheFmOU+BQ82QKTPr3ve1YTxk52iyJEFLrZZ:R3zEaBKBBheBUEQ8gTPLve1exkdyJcj

Score

10^/10

gcleaner discovery loader

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9360f1b394216dde2d02525c02f8118ebc0a047a810838e848b01df5dffd6cfc.exe

Resource

win7-20240903-en

gcleaner discovery loader

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

9360f1b394216dde2d02525c02f8118ebc0a047a810838e848b01df5dffd6cfc.exe

Resource

win10v2004-20241007-en

gcleaner discovery loader

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  9360f1b394216dde2d02525c02f8118ebc0a047a810838e848b01df5dffd6cfc
- Size
  
  421KB
- MD5
  
  1a0fe993e2a9709c41e3388a9ad284c1
- SHA1
  
  9c233e8cacca30e291184a4eff341d453648e42d
- SHA256
  
  9360f1b394216dde2d02525c02f8118ebc0a047a810838e848b01df5dffd6cfc
- SHA512
  
  fbcbad5aac33edc82cba79d806939af7c5ea3ad8c43b4333725e56fa160093d885e8ba61e55907d7c37205f11a6ea489ec4b4ff4d45321868c1f4f3f2e16179d
- SSDEEP
  
  6144:ROWzR3+a9XKBBheFmOU+BQ82QKTPr3ve1YTxk52iyJEFLrZZ:R3zEaBKBBheBUEQ8gTPLve1exkdyJcj
Score

10^/10

gcleaner discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

gcleanerdiscoveryloader

behavioral2

gcleanerdiscoveryloader

© 2018-2024

Terms | Privacy