Resubmissions
10-11-2024 21:28
241110-1bhk6avgrr 10Analysis
-
max time kernel
1795s -
max time network
1824s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 02:47
General
-
Target
0db3c21dec09a297e99a07ec1ebd007146adfbcb3c8f0d4a3f88868778c6aef9.exe
-
Size
317KB
-
MD5
fe62aba35fd5f1c6ca2c1c8be6c27ed3
-
SHA1
b1912c42ae6742ee1f85be843ad3f66a45372464
-
SHA256
0db3c21dec09a297e99a07ec1ebd007146adfbcb3c8f0d4a3f88868778c6aef9
-
SHA512
2d4fedf8c40f2796539a046277ea7f8b6a514e2cecd0b630e8a3a137254a627c873684d247f9e01b53cda4cd36dfa504e9ef1e3c1ed521f9343d45d41032b92a
-
SSDEEP
6144:fhu1FLTeIjxfniZ5nr6qBgplf95QfGuYjuK2uPbcRItN:fhuXOAfnErgplf3huNuPb0I
Malware Config
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0db3c21dec09a297e99a07ec1ebd007146adfbcb3c8f0d4a3f88868778c6aef9.exe"C:\Users\Admin\AppData\Local\Temp\0db3c21dec09a297e99a07ec1ebd007146adfbcb3c8f0d4a3f88868778c6aef9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
272KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
272KB
-
Filesize
1.7MB