General

  • Target

    a3bceed427167d19d50d56ba8eb2ba39a52f24d43e39550d3221008f494cd558

  • Size

    2.3MB

  • Sample

    241128-kx36zsyker

  • MD5

    76544e942a50665cf1e6b9bfc43c81a2

  • SHA1

    01f2dbd24cfdc0153d5b11e13fd3529c0ce9513a

  • SHA256

    a3bceed427167d19d50d56ba8eb2ba39a52f24d43e39550d3221008f494cd558

  • SHA512

    e3c42df060d8d37f9ec8a4fe6bbc427a6f30df39705d297ec75521394aae78cb0bd670dca35d4786040612a962d3468979188c07e3ee78d909a52d43c52a2316

  • SSDEEP

    49152:/1P1A151y31WY1U1c1rWA9Wz5vPg05yTD5r0UfjfNAJiM+aPe:/1P1A151y3151U1c1rWaW1vPg05yT1rd

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Attributes
  • url_path

    /default/puk.php

Targets

    • Target

      a3bceed427167d19d50d56ba8eb2ba39a52f24d43e39550d3221008f494cd558

    • Size

      2.3MB

    • MD5

      76544e942a50665cf1e6b9bfc43c81a2

    • SHA1

      01f2dbd24cfdc0153d5b11e13fd3529c0ce9513a

    • SHA256

      a3bceed427167d19d50d56ba8eb2ba39a52f24d43e39550d3221008f494cd558

    • SHA512

      e3c42df060d8d37f9ec8a4fe6bbc427a6f30df39705d297ec75521394aae78cb0bd670dca35d4786040612a962d3468979188c07e3ee78d909a52d43c52a2316

    • SSDEEP

      49152:/1P1A151y31WY1U1c1rWA9Wz5vPg05yTD5r0UfjfNAJiM+aPe:/1P1A151y3151U1c1rWaW1vPg05yT1rd

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks