gcleaner | ed59cff22b185a25daa7955fa62577cd32ca3049c05f994af2c2bc99d47fe911

General

Target
jaffacakes118_ed59cff22b185a25daa7955fa62577cd32ca3049c05f994af2c2bc99d47fe911.bin
Size 4.8MB
Sample260912-e1n9cadb86
SHA256 ed59cff22b185a25daa7955fa62577cd32ca3049c05f994af2c2bc99d47fe911
MD5 53752d39687dfcbf184952c13e618cc5
SHA1 938b4e1f86ea3999cfffdad9ba29c33ea39e8df5
SHA512 6ede3d338b8a42c6628f394b5e22d1565e93a239d5c049c61bcc27f9d1368786ce4a10112b18f0afb8404a83e429b9e5b76a0458013d5c0c6dcb5b1a19ba0ec4
SSDEEP 49152:YKlFrMIPvgkEkejbyJ+pXNtlrIKHey60X42dV/VL1bS/O3v7HPQbpVIIsTMX0oP:YKlFrMb+mN/rIN0X4mbtf72P66
TLSH
T11B36F0699B409B71C2F213FEC59B9735BA972E432C399D7236F50E046B25206E04EF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_ed59cff22b185a25daa7955fa62577cd32ca3049c05f994af2c2bc99d47fe911.bin
- Size 4.8MB
- SHA256 ed59cff22b185a25daa7955fa62577cd32ca3049c05f994af2c2bc99d47fe911
- MD5 53752d39687dfcbf184952c13e618cc5
- SHA1 938b4e1f86ea3999cfffdad9ba29c33ea39e8df5
- SHA512 6ede3d338b8a42c6628f394b5e22d1565e93a239d5c049c61bcc27f9d1368786ce4a10112b18f0afb8404a83e429b9e5b76a0458013d5c0c6dcb5b1a19ba0ec4
- SSDEEP 49152:YKlFrMIPvgkEkejbyJ+pXNtlrIKHey60X42dV/VL1bS/O3v7HPQbpVIIsTMX0oP:YKlFrMb+mN/rIN0X4mbtf72P66
- TLSH
  T11B36F0699B409B71C2F213FEC59B9735BA972E432C399D7236F50E046B25206E04EF27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2