gcleaner | 01fea9527eac85ed7d6e271f93e185950aff503554b8682ad3ba5d3e25dc03f1

General

Target
jaffacakes118_01fea9527eac85ed7d6e271f93e185950aff503554b8682ad3ba5d3e25dc03f1.bin
Size 4.9MB
Sample260912-e8c62syfqh
SHA256 01fea9527eac85ed7d6e271f93e185950aff503554b8682ad3ba5d3e25dc03f1
MD5 bc575e9330c01f20e8a984318efb13ac
SHA1 13b95f6dc7b55986bf8748537c7475e99d0e7143
SHA512 c380a9fc9209a0f6dac5f09b7fb473e9c2c87abd405a72e69e97aa79e0fde9440ff6222809bb8168ba22188c869735dca55875d92e7b7b8bbbf7431c4c915295
SSDEEP 49152:3w3/T0sKvnyz2lzBvvHbSbN6JNuASl2l3JDaM56dGyNXDSHlhi54Mq33HiG0Nmb7:3w3/0nnlV4FqiG30QGHY
TLSH
T1D936F12DE2B59A72FD322F3A7CAF7394D321ED113F68684232943D085D77692A476063
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_01fea9527eac85ed7d6e271f93e185950aff503554b8682ad3ba5d3e25dc03f1.bin
- Size 4.9MB
- SHA256 01fea9527eac85ed7d6e271f93e185950aff503554b8682ad3ba5d3e25dc03f1
- MD5 bc575e9330c01f20e8a984318efb13ac
- SHA1 13b95f6dc7b55986bf8748537c7475e99d0e7143
- SHA512 c380a9fc9209a0f6dac5f09b7fb473e9c2c87abd405a72e69e97aa79e0fde9440ff6222809bb8168ba22188c869735dca55875d92e7b7b8bbbf7431c4c915295
- SSDEEP 49152:3w3/T0sKvnyz2lzBvvHbSbN6JNuASl2l3JDaM56dGyNXDSHlhi54Mq33HiG0Nmb7:3w3/0nnlV4FqiG30QGHY
- TLSH
  T1D936F12DE2B59A72FD322F3A7CAF7394D321ED113F68684232943D085D77692A476063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2