gcleaner

General

Target
SecuriteInfo.com.Trojan.Inject5.57588.22457.22331.exe
Size 3.3MB
Sample250621-2be1psvnv2
SHA256 78eaaf970343b836d80dc13864c645b2b8a4ab6ea0ffab2294d5c0b7b085cc56
MD5 4d94af2aad94f415fc0d3130c9c09804
SHA1 f6e514cecbb5eeef3b3dfbdcd7193325e2f84264
SHA512 3cb9ae3ae5bf00f72eed61426dd0430fbe9f71ad3c5efea0460aba706dd4f8c300bf580ac780d1e84792cc239e769ffc168d0b8461fbe328a4902dd7667a3232
SSDEEP 49152:tvI8gzxfUvLCCjpIzMvaKh9wkvj7AzwMBGvjFDGoW0tRTW2UegR:BI8gSCCKzyaKh1j7KwMBGvjp0ARTAR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

45.91.200.135

Targets

- Target
  SecuriteInfo.com.Trojan.Inject5.57588.22457.22331.exe
- Size 3.3MB
- SHA256 78eaaf970343b836d80dc13864c645b2b8a4ab6ea0ffab2294d5c0b7b085cc56
- MD5 4d94af2aad94f415fc0d3130c9c09804
- SHA1 f6e514cecbb5eeef3b3dfbdcd7193325e2f84264
- SHA512 3cb9ae3ae5bf00f72eed61426dd0430fbe9f71ad3c5efea0460aba706dd4f8c300bf580ac780d1e84792cc239e769ffc168d0b8461fbe328a4902dd7667a3232
- SSDEEP 49152:tvI8gzxfUvLCCjpIzMvaKh9wkvj7AzwMBGvjFDGoW0tRTW2UegR:BI8gSCCKzyaKh1j7KwMBGvjp0ARTAR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gcleaner discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Gcleaner family

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2