gcleaner | cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b

General

Target
jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.bin
Size 3.3MB
Sample260911-2ae93stfpg
SHA256 cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b
MD5 d72e285f04b79faf6c43cf4a0a3d7d54
SHA1 662e611f513bfd2bd75a438da3649d7d0634a314
SHA512 f4f24d7265f412a678a21a859e692cc5624e10f121c486a8455be459aa51f63847acdc3d027093e2d662b3df00378a38c27836a5a1000111553af0d94111f23e
SSDEEP 98304:lDaS8oMw4urT5XoFii5RXJ/mhXliAFLMvxfW5bRTJApg57Tz:lOLh2o/m/ioT3JAO3
TLSH
T1E7F5025260923339D37B5AF449274B20C452BD877AB0F049F6F6509FDF22F86A51CAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b.bin
- Size 3.3MB
- SHA256 cea9ddbb629cdb49722311ed3e3aa6c3aa4a53d075531c2f881b3a1694e38d6b
- MD5 d72e285f04b79faf6c43cf4a0a3d7d54
- SHA1 662e611f513bfd2bd75a438da3649d7d0634a314
- SHA512 f4f24d7265f412a678a21a859e692cc5624e10f121c486a8455be459aa51f63847acdc3d027093e2d662b3df00378a38c27836a5a1000111553af0d94111f23e
- SSDEEP 98304:lDaS8oMw4urT5XoFii5RXJ/mhXliAFLMvxfW5bRTJApg57Tz:lOLh2o/m/ioT3JAO3
- TLSH
  T1E7F5025260923339D37B5AF449274B20C452BD877AB0F049F6F6509FDF22F86A51CAB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2