gcleaner | 36c3dc9e4094ff04ce2bb4c5fe14363aba3f6abdcf2db015f1f3efee3e8a262e

General

Target
jaffacakes118_36c3dc9e4094ff04ce2bb4c5fe14363aba3f6abdcf2db015f1f3efee3e8a262e.bin
Size 5.1MB
Sample260912-ajvmkswarf
SHA256 36c3dc9e4094ff04ce2bb4c5fe14363aba3f6abdcf2db015f1f3efee3e8a262e
MD5 c16e59644f0933ce76dfd5bd724d9435
SHA1 7e131f7503dff0ecf10a72e4326ebcc44291e11a
SHA512 3ae800cacf46711ab7e5952907d264876ae480b9fbec4c891d4252c1f8c0daadee0d06c373b33d6ba807818e1a1e27e30fc06f392a7015ef2329bf4795fd7a56
SSDEEP 98304:7kihHU+zVqgZp3AeT9CCbM6EdkyV07rkKh5KtjFMI2rlaZq:7iEHRAM/LHStjFB2r4Zq
TLSH
T1C136E136F0473577D4721E7C8E3F1B5DB425F9121C78AC4EAB961C88EE293816CA8297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_36c3dc9e4094ff04ce2bb4c5fe14363aba3f6abdcf2db015f1f3efee3e8a262e.bin
- Size 5.1MB
- SHA256 36c3dc9e4094ff04ce2bb4c5fe14363aba3f6abdcf2db015f1f3efee3e8a262e
- MD5 c16e59644f0933ce76dfd5bd724d9435
- SHA1 7e131f7503dff0ecf10a72e4326ebcc44291e11a
- SHA512 3ae800cacf46711ab7e5952907d264876ae480b9fbec4c891d4252c1f8c0daadee0d06c373b33d6ba807818e1a1e27e30fc06f392a7015ef2329bf4795fd7a56
- SSDEEP 98304:7kihHU+zVqgZp3AeT9CCbM6EdkyV07rkKh5KtjFMI2rlaZq:7iEHRAM/LHStjFB2r4Zq
- TLSH
  T1C136E136F0473577D4721E7C8E3F1B5DB425F9121C78AC4EAB961C88EE293816CA8297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2