General

  • Target

    0406454e830d3e6f20671dc92fdeaefb58c1afba70c94601377f15fc62f4ba2fN.exe

  • Size

    2.3MB

  • Sample

    241222-tj3gzasqey

  • MD5

    5f40e243177f0b5b884afe1c3c964130

  • SHA1

    4cdab43ba9a9924dca02682ad24375c61dbf050a

  • SHA256

    0406454e830d3e6f20671dc92fdeaefb58c1afba70c94601377f15fc62f4ba2f

  • SHA512

    a12ae2bc4e71312a5831f19894cc8433e09cdbe785879112511644f4618c299e049681f3233d9ea72befa1458c67d1164070d03ab8823a9de41e1a5d14f56f44

  • SSDEEP

    49152:AGNjxMcyo1CFX5x7fcVq2b+Qp30Ys6soqD+XYCqwKQOsjQ3OOKX:dNjxu+eX5x7fcVq2h3m6soq6XYBwbOsv

Malware Config

Extracted

Family

gcleaner

C2

208.67.106.156

87.251.71.107

193.151.183.73

208.67.104.141

Attributes
  • url_path

    /i.php

    /get.php

    /setup.php

    /setup.php

Targets

    • Target

      0406454e830d3e6f20671dc92fdeaefb58c1afba70c94601377f15fc62f4ba2fN.exe

    • Size

      2.3MB

    • MD5

      5f40e243177f0b5b884afe1c3c964130

    • SHA1

      4cdab43ba9a9924dca02682ad24375c61dbf050a

    • SHA256

      0406454e830d3e6f20671dc92fdeaefb58c1afba70c94601377f15fc62f4ba2f

    • SHA512

      a12ae2bc4e71312a5831f19894cc8433e09cdbe785879112511644f4618c299e049681f3233d9ea72befa1458c67d1164070d03ab8823a9de41e1a5d14f56f44

    • SSDEEP

      49152:AGNjxMcyo1CFX5x7fcVq2b+Qp30Ys6soqD+XYCqwKQOsjQ3OOKX:dNjxu+eX5x7fcVq2h3m6soq6XYBwbOsv

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks