gcleaner

General

Target
random.exe
Size 3.3MB
Sample250809-bqys9awkz3
SHA256 9cb2f4a1fc1bc3bd4ca73397789fc0ef9305e42ca539efd8df878ae4fbc2822a
MD5 a37f4fe3c7a87f9112dcf4982c4303ef
SHA1 9de4f685a13194cce455d31bb22132bcad06d446
SHA512 e5316a917350a5afd137bdd5a068cc804d2eeca10c12b11e08701e3641f0953fa278b5d3c66eef88a56159e6a88792e28b269f0dfc540526cea58fee012fa0f2
SSDEEP 98304:FDaS8ou/iRWUj5aA72CNl2x+Qy+NZetSkhB2LQ:FOLB/iRNjs5ya+X+QSkb2LQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  random.exe
- Size 3.3MB
- SHA256 9cb2f4a1fc1bc3bd4ca73397789fc0ef9305e42ca539efd8df878ae4fbc2822a
- MD5 a37f4fe3c7a87f9112dcf4982c4303ef
- SHA1 9de4f685a13194cce455d31bb22132bcad06d446
- SHA512 e5316a917350a5afd137bdd5a068cc804d2eeca10c12b11e08701e3641f0953fa278b5d3c66eef88a56159e6a88792e28b269f0dfc540526cea58fee012fa0f2
- SSDEEP 98304:FDaS8ou/iRWUj5aA72CNl2x+Qy+NZetSkhB2LQ:FOLB/iRNjs5ya+X+QSkb2LQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gcleaner discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Gcleaner family

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2