General

  • Target

    299b3e966f5782819336a939759760b40fa43e49ae3a48fb58d10029497fba48

  • Size

    2.4MB

  • Sample

    250207-p966masqfp

  • MD5

    430b4bd93bd51374abde4051dfc78388

  • SHA1

    bc69df37172d98f451a2cebe5825f1b50cb4df78

  • SHA256

    299b3e966f5782819336a939759760b40fa43e49ae3a48fb58d10029497fba48

  • SHA512

    fc3c83808444d3d8128e8e51426cd51d3f7ad56de8f325f037cef4321ed820862b0ac1d441c5990accef0ab2be3f7c51ac08897ae042d50bc9540a2bb3e5bf20

  • SSDEEP

    24576:W6O76DY1mxqD3WxR6exvoShwtrpkTNWUATqxOG5QChNg8Eb2KGe9yz3Ui:Wf76DGmxqD3/exvocNWXHhHGe9yX

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Attributes
  • url_path

    /default/puk.php

Targets

    • Target

      299b3e966f5782819336a939759760b40fa43e49ae3a48fb58d10029497fba48

    • Size

      2.4MB

    • MD5

      430b4bd93bd51374abde4051dfc78388

    • SHA1

      bc69df37172d98f451a2cebe5825f1b50cb4df78

    • SHA256

      299b3e966f5782819336a939759760b40fa43e49ae3a48fb58d10029497fba48

    • SHA512

      fc3c83808444d3d8128e8e51426cd51d3f7ad56de8f325f037cef4321ed820862b0ac1d441c5990accef0ab2be3f7c51ac08897ae042d50bc9540a2bb3e5bf20

    • SSDEEP

      24576:W6O76DY1mxqD3WxR6exvoShwtrpkTNWUATqxOG5QChNg8Eb2KGe9yz3Ui:Wf76DGmxqD3/exvocNWXHhHGe9yX

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Gcleaner family

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks