Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-01-2025 11:44
General
-
Target
48bcb229bec55fa35a579870073247dbfe676acb65130ee7fd3edfa2085aba64.exe
-
Size
2.9MB
-
MD5
f212366ef83f5e89633e3b1aac35ea7f
-
SHA1
9b56c070be542fdd893e3de35c8a476ae255979a
-
SHA256
48bcb229bec55fa35a579870073247dbfe676acb65130ee7fd3edfa2085aba64
-
SHA512
acf6c21a0d495c00e9ec1c47fa3b32ecde55becf4d179b95f298b5aafdb19addcd615054768a2efbffb66cdfb058cc80789d15036673e01675a2f91f57539e69
-
SSDEEP
24576:dC7ZkEgvMZL0YodapBz6pNshfSdF+Ms2haFPlURSDoAHq62UTFm6SzGEfN+B4FB:s9CyL0cPfSeVlJvKWp3S/lBf
Malware Config
Extracted
gcleaner
208.67.106.156
37.139.129.24
193.151.183.73
208.67.104.141
-
url_path
/i.php
/get.php
/setup.php
/setup.php
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\48bcb229bec55fa35a579870073247dbfe676acb65130ee7fd3edfa2085aba64.exe"C:\Users\Admin\AppData\Local\Temp\48bcb229bec55fa35a579870073247dbfe676acb65130ee7fd3edfa2085aba64.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.9MB
-
Filesize
256KB
-
Filesize
16.9MB
-
Filesize
16.9MB
-
Filesize
256KB