General

  • Target

    e531c8d72ad9d87157fbff37499ad6edbcf689a0a856c6f8cb77959d2e8b6977

  • Size

    2.9MB

  • Sample

    241216-bhjpcswlfy

  • MD5

    b749cdc79abd19270159e513842d256d

  • SHA1

    c6f6d0a8244d99750b25aaaafbbfe9526a8d5b24

  • SHA256

    e531c8d72ad9d87157fbff37499ad6edbcf689a0a856c6f8cb77959d2e8b6977

  • SHA512

    925827ec23537abf1c601631c31c54ddcdf258d5a0841e81643c099241222820bc6ac66c722ae68acacc5bc8a3fe0c3b21966d2858030ba2ddc570f7e45c5e49

  • SSDEEP

    49152:3+28jWNtmMOWw9Hj18euhyJoyU29FgY7BCQZXBWXUz+O8F:u28jWNtmMZw9D18euCU29FgYV7XBIUzQ

Malware Config

Extracted

Family

gcleaner

C2

62.197.136.41

87.251.71.107

62.197.136.196

2.56.57.69

Attributes
  • url_path

    /i.php

    /get.php

    /setup.php

    /setup.php

Targets

    • Target

      e531c8d72ad9d87157fbff37499ad6edbcf689a0a856c6f8cb77959d2e8b6977

    • Size

      2.9MB

    • MD5

      b749cdc79abd19270159e513842d256d

    • SHA1

      c6f6d0a8244d99750b25aaaafbbfe9526a8d5b24

    • SHA256

      e531c8d72ad9d87157fbff37499ad6edbcf689a0a856c6f8cb77959d2e8b6977

    • SHA512

      925827ec23537abf1c601631c31c54ddcdf258d5a0841e81643c099241222820bc6ac66c722ae68acacc5bc8a3fe0c3b21966d2858030ba2ddc570f7e45c5e49

    • SSDEEP

      49152:3+28jWNtmMOWw9Hj18euhyJoyU29FgY7BCQZXBWXUz+O8F:u28jWNtmMZw9D18euCU29FgYV7XBIUzQ

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

MITRE ATT&CK Enterprise v15

Tasks