gcleaner | 6ac9951f0b0b5178713d9fc56f198166cff1a70ba6ff221c0de8f6ad00981c6b

General

Target
jaffacakes118_6ac9951f0b0b5178713d9fc56f198166cff1a70ba6ff221c0de8f6ad00981c6b.bin
Size 4.9MB
Sample260912-eahzmsal4t
SHA256 6ac9951f0b0b5178713d9fc56f198166cff1a70ba6ff221c0de8f6ad00981c6b
MD5 97e886fa5f9375d881def1b51609b6c4
SHA1 408ac1d9361bd8efbadffcaabce2763da24795ef
SHA512 928ccb5c926530559644ad150ab397b40cb7cacf5f615dfcb8c5c4125fafeb9118bf5e8515d9b2e0921223496b113e96c1ad609395c1e4c76f723048638a97dd
SSDEEP 49152:5Sij5xMAb+MbUeNKMgolcMDbvfcIRCQ+TzHZ6iXI1gO4FLZ:5SiPpbZY/oeaxJ+B2kl
TLSH
T16636F0C6F18050F1F5A62F3BC8BB4371F51CB8580EE4578106EB6E28A6396862DD5DB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_6ac9951f0b0b5178713d9fc56f198166cff1a70ba6ff221c0de8f6ad00981c6b.bin
- Size 4.9MB
- SHA256 6ac9951f0b0b5178713d9fc56f198166cff1a70ba6ff221c0de8f6ad00981c6b
- MD5 97e886fa5f9375d881def1b51609b6c4
- SHA1 408ac1d9361bd8efbadffcaabce2763da24795ef
- SHA512 928ccb5c926530559644ad150ab397b40cb7cacf5f615dfcb8c5c4125fafeb9118bf5e8515d9b2e0921223496b113e96c1ad609395c1e4c76f723048638a97dd
- SSDEEP 49152:5Sij5xMAb+MbUeNKMgolcMDbvfcIRCQ+TzHZ6iXI1gO4FLZ:5SiPpbZY/oeaxJ+B2kl
- TLSH
  T16636F0C6F18050F1F5A62F3BC8BB4371F51CB8580EE4578106EB6E28A6396862DD5DB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2