General

  • Target

    088521c9919c796fda14c3fe63e2e591d3bd3ef15832dd061a9bdea0807027afN.exe

  • Size

    1.2MB

  • Sample

    241231-w19zgsvpep

  • MD5

    633eb4457a0fbb406c3ff46b144659e0

  • SHA1

    d476daae5bafedfecd974c2178811c5bccd42a63

  • SHA256

    088521c9919c796fda14c3fe63e2e591d3bd3ef15832dd061a9bdea0807027af

  • SHA512

    c98985ba97936e6d07e5f442d889089b12a2b018db6719e2b0417a3431f2fbb7763ef2085e8e2b1d3433498391e62d4a70141123505c139c43f43664ce7e69c0

  • SSDEEP

    24576:a2exnN84v8TAGe4steUTnVjS/hg0Lw/LdQINtTWRUo6x/UEHM6a723:a2WcT/eb/TnVm/h/wdtTWRU9st23

Malware Config

Extracted

Family

gcleaner

C2

85.208.136.148

85.208.136.56

85.208.136.48

85.208.136.87

Attributes
  • url_path

    /x.php

    /soft.php

    /soft.php

Targets

    • Target

      088521c9919c796fda14c3fe63e2e591d3bd3ef15832dd061a9bdea0807027afN.exe

    • Size

      1.2MB

    • MD5

      633eb4457a0fbb406c3ff46b144659e0

    • SHA1

      d476daae5bafedfecd974c2178811c5bccd42a63

    • SHA256

      088521c9919c796fda14c3fe63e2e591d3bd3ef15832dd061a9bdea0807027af

    • SHA512

      c98985ba97936e6d07e5f442d889089b12a2b018db6719e2b0417a3431f2fbb7763ef2085e8e2b1d3433498391e62d4a70141123505c139c43f43664ce7e69c0

    • SSDEEP

      24576:a2exnN84v8TAGe4steUTnVjS/hg0Lw/LdQINtTWRUo6x/UEHM6a723:a2WcT/eb/TnVm/h/wdtTWRU9st23

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks