Analysis
-
max time kernel
95s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
22/02/2025, 12:01
General
-
Target
0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4.exe
-
Size
1.8MB
-
MD5
f39f9c8fad7e3d2dc5918e3581a0676e
-
SHA1
d5d306a14f7cf9d57b79d8a67f82ab285df63d19
-
SHA256
0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4
-
SHA512
d1b7e239bbeabb339e477b2fdac0d5749ac4da6eee1068439aed1052dfe580a5c4cbcb20b3a60a58cbecbc1a40406e9340807f7c7c89a77184404e75a06e9593
-
SSDEEP
24576:HI8+tQayGWHPApPoXDIDauxXRhezuXtj6sD+QGR4aWR1:vwQayG0EbxXSCsW+
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
85.31.45.39
85.31.45.250
85.31.45.251
85.31.45.88
Attributes
-
url_path
/b.php
/d.php
/d.php
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
Downloads MZ/PE file 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4.exe"C:\Users\Admin\AppData\Local\Temp\0bff5a3e56f8b775e3c30ef19868bb42e612981336191ee1fdbb333fe156c1b4.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.8MB
-
Filesize
272KB
-
Filesize
15.8MB
-
Filesize
272KB
-
Filesize
15.8MB