gcleaner | a2783ea749ac9dcc962ae73f09e433fc227957a15a900cad88184c44b01d22a6

General

Target
jaffacakes118_a2783ea749ac9dcc962ae73f09e433fc227957a15a900cad88184c44b01d22a6.bin
Size 4.9MB
Sample260912-egvxsayckc
SHA256 a2783ea749ac9dcc962ae73f09e433fc227957a15a900cad88184c44b01d22a6
MD5 816515dd08adfb3a8e4728038263fd9f
SHA1 8f70892e93d48386c5fac1c90203edb648b8b37c
SHA512 af62707096b631607fb2391de807114ee0994b93338e5981c60280417ff2cd2bd82513d46cdc74ac09040caf5bf34d430344306006a99e0062fb8681bc8a704c
SSDEEP 49152:4Sij5x5Ndjf4vP+eVjLM+ZV8MzLJKAvUgY9UUg6QMhnSKM1nf/cy2PfWfv89malA:4SiPdjfKX9tKDwvSnJMdHjVymalpkUA
TLSH
T1B236E0097B94A532E37EC338EBEF475861B8A9663C94450B07E7EC4426E8243D4B52F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_a2783ea749ac9dcc962ae73f09e433fc227957a15a900cad88184c44b01d22a6.bin
- Size 4.9MB
- SHA256 a2783ea749ac9dcc962ae73f09e433fc227957a15a900cad88184c44b01d22a6
- MD5 816515dd08adfb3a8e4728038263fd9f
- SHA1 8f70892e93d48386c5fac1c90203edb648b8b37c
- SHA512 af62707096b631607fb2391de807114ee0994b93338e5981c60280417ff2cd2bd82513d46cdc74ac09040caf5bf34d430344306006a99e0062fb8681bc8a704c
- SSDEEP 49152:4Sij5x5Ndjf4vP+eVjLM+ZV8MzLJKAvUgY9UUg6QMhnSKM1nf/cy2PfWfv89malA:4SiPdjfKX9tKDwvSnJMdHjVymalpkUA
- TLSH
  T1B236E0097B94A532E37EC338EBEF475861B8A9663C94450B07E7EC4426E8243D4B52F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2