Extracted

Extracted

• • Target
    Setup.exe
  • Size 7.0MB
  • SHA256 2e1e3bd6da854b3b4517c5e51754327308a9f8b7855aeab11d9cf36f3a4cc92e
  • MD5 58e64cf9018578e85bbac64842367c8b
  • SHA1 ba30ec2d232cb4a0cc7104229ded5cc6cf78f19a
  • SHA512 dc278db545aaf15d9be3a2719fc2c4cd6ed3286fd5d68cf09cc4a48000a9767b9d3d20374c4cc2fbde5a263444353fc7a57625cebd0b8377f995fde592b168db
  • SSDEEP 196608:rkCjdQOA/SQfxlsyAdPOIlE3KCYNfcq+dnYwudRN:gCjFA/frIGIlEpYNfcqt3N
  • TLSH
    T163762309EBA4357AFC328234CEB386E1DB71381A036195EB17D4B56B1EBB191C53E721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerloaderspywarestealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4