gcleaner

General

Target
file.exe
Size 3.5MB
Sample250914-ely51a1vct
SHA256 e0c21356fdd99942e1d9e89f0afee73e5f14772bf5f8836ab8b96a997ba76768
MD5 0521a12068e89b1482eadcadd0da0481
SHA1 e3e732d9976d86f0d41a1243486c5cd340ecfe02
SHA512 e7b64aafdd9f84cc43fa5670c4a106bbe54416d3b11f0337bee659b67e3f2ac074992bceb4d56ae3514c89bb5edf923a765655f60cec90735bed5b26aa6dfedd
SSDEEP 98304:awWqljwphMk6xuc2LTNqp5zUIGmnA6Am7mTlPFTVW97N+vmk0Ps0nZOv:aVIFUIGaA/WmT/BW9kvmvs0c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  file.exe
- Size 3.5MB
- SHA256 e0c21356fdd99942e1d9e89f0afee73e5f14772bf5f8836ab8b96a997ba76768
- MD5 0521a12068e89b1482eadcadd0da0481
- SHA1 e3e732d9976d86f0d41a1243486c5cd340ecfe02
- SHA512 e7b64aafdd9f84cc43fa5670c4a106bbe54416d3b11f0337bee659b67e3f2ac074992bceb4d56ae3514c89bb5edf923a765655f60cec90735bed5b26aa6dfedd
- SSDEEP 98304:awWqljwphMk6xuc2LTNqp5zUIGmnA6Am7mTlPFTVW97N+vmk0Ps0nZOv:aVIFUIGaA/WmT/BW9kvmvs0c
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Gcleaner family

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2