gcleaner

General

Target
file.exe
Size 3.4MB
Sample250930-epa8cazzcw
SHA256 e8bd4db9b069b622540be5f46b4fdd426d1488dc6841625d8a5c0ce9b9f652b1
MD5 33e80aae647a725c1918d10a731587d9
SHA1 03063d92b6dc4afc5c0c41002b6e9601304152d3
SHA512 5861b0125969883c47dc9bdd903f6b58044394a6688d87740a9b55017946fc45a9069129f20c15619ced3b5f7f13316bb8a62604766c44dbd0465536a2677d40
SSDEEP 49152:Nh0ZbvK0+zBdoAvvQhRe7D1xW6BCbxB2TfwRplBWtETj78ZrqlrpssO:NhCLPadoEvi07Kxz2tY7KWlssO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  file.exe
- Size 3.4MB
- SHA256 e8bd4db9b069b622540be5f46b4fdd426d1488dc6841625d8a5c0ce9b9f652b1
- MD5 33e80aae647a725c1918d10a731587d9
- SHA1 03063d92b6dc4afc5c0c41002b6e9601304152d3
- SHA512 5861b0125969883c47dc9bdd903f6b58044394a6688d87740a9b55017946fc45a9069129f20c15619ced3b5f7f13316bb8a62604766c44dbd0465536a2677d40
- SSDEEP 49152:Nh0ZbvK0+zBdoAvvQhRe7D1xW6BCbxB2TfwRplBWtETj78ZrqlrpssO:NhCLPadoEvi07Kxz2tY7KWlssO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery gcleaner loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Gcleaner family

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2