gcleaner | 16f7f3eacc135bb026a04a885b66649f6fbb1c56bc66ec822d1ab6ba52d95e65

General

Target
jaffacakes118_16f7f3eacc135bb026a04a885b66649f6fbb1c56bc66ec822d1ab6ba52d95e65.bin
Size 4.8MB
Sample260912-e7yrcsyfpe
SHA256 16f7f3eacc135bb026a04a885b66649f6fbb1c56bc66ec822d1ab6ba52d95e65
MD5 d84f37997d5ef9a43cc4a481b8447e10
SHA1 b2b152ef6e685fbc1fda3656d007f9663cf62c26
SHA512 b94bd02e438418056dbec7cc21ed87184af3b1cf21c6beb546a6a360c3cc1e699466b0b5d08e85ca0c9892d615f42c673059e382cbca7444d592f13c1427d630
SSDEEP 98304:0gjgyg2VFqGgsXd5lzuA/RH6IO0X/cL3fGe:0+gyg2rLgMd58AZa0kbee
TLSH
T14636F115A0E17035E057E77A2B6F93C8BF2A7B112C085557234B9C48BFF9081A69FD8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_16f7f3eacc135bb026a04a885b66649f6fbb1c56bc66ec822d1ab6ba52d95e65.bin
- Size 4.8MB
- SHA256 16f7f3eacc135bb026a04a885b66649f6fbb1c56bc66ec822d1ab6ba52d95e65
- MD5 d84f37997d5ef9a43cc4a481b8447e10
- SHA1 b2b152ef6e685fbc1fda3656d007f9663cf62c26
- SHA512 b94bd02e438418056dbec7cc21ed87184af3b1cf21c6beb546a6a360c3cc1e699466b0b5d08e85ca0c9892d615f42c673059e382cbca7444d592f13c1427d630
- SSDEEP 98304:0gjgyg2VFqGgsXd5lzuA/RH6IO0X/cL3fGe:0+gyg2rLgMd58AZa0kbee
- TLSH
  T14636F115A0E17035E057E77A2B6F93C8BF2A7B112C085557234B9C48BFF9081A69FD8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2