gcleaner | e12d3233f2c06780cce7d000b40014300d622840a11527baebc61a7018d526d0

General

Target
jaffacakes118_e12d3233f2c06780cce7d000b40014300d622840a11527baebc61a7018d526d0.bin
Size 4.8MB
Sample260911-3pht7axwgs
SHA256 e12d3233f2c06780cce7d000b40014300d622840a11527baebc61a7018d526d0
MD5 bf60120432a0a3b078f7eeed6f4fdbb1
SHA1 bb26170f1d8f8c009effd8a120c792f3c8778428
SHA512 3e659b318c446740d8b005ffa194418c8e4784e4edd159f490de29460a98d8efe7d6a480d9ede31828950baea9d965446df3ee9bc2cc2d6cbc109c85b899afea
SSDEEP 49152:6OU4JKT0BlORatfPQlqDem2CTg7l6X+2Xy8oF+yUcwEScM0oNtcTdy8Ec8:6OpDBlOkjD/YlKji8sUnEScaNtL8Ec8
TLSH
T13836E152B2D08732E1E235BD8E67A3754469596E2ED0F80F1BA01D84FD3A1B3F43568E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_e12d3233f2c06780cce7d000b40014300d622840a11527baebc61a7018d526d0.bin
- Size 4.8MB
- SHA256 e12d3233f2c06780cce7d000b40014300d622840a11527baebc61a7018d526d0
- MD5 bf60120432a0a3b078f7eeed6f4fdbb1
- SHA1 bb26170f1d8f8c009effd8a120c792f3c8778428
- SHA512 3e659b318c446740d8b005ffa194418c8e4784e4edd159f490de29460a98d8efe7d6a480d9ede31828950baea9d965446df3ee9bc2cc2d6cbc109c85b899afea
- SSDEEP 49152:6OU4JKT0BlORatfPQlqDem2CTg7l6X+2Xy8oF+yUcwEScM0oNtcTdy8Ec8:6OpDBlOkjD/YlKji8sUnEScaNtL8Ec8
- TLSH
  T13836E152B2D08732E1E235BD8E67A3754469596E2ED0F80F1BA01D84FD3A1B3F43568E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2