gcleaner | 2030ad089165675e54e6a9aaacf4f7326a0d107c04b7092cb415c44fdb8d8bd4

General

Target
jaffacakes118_2030ad089165675e54e6a9aaacf4f7326a0d107c04b7092cb415c44fdb8d8bd4.bin
Size 4.9MB
Sample260912-evxcrsan71
SHA256 2030ad089165675e54e6a9aaacf4f7326a0d107c04b7092cb415c44fdb8d8bd4
MD5 01085e710f9534c0c14a1ba14b3892ce
SHA1 c04f0e976064888c8c48f24afcc03861d95b6cba
SHA512 e4b28d97c19af1b59563dcce779ddd6f53aa1ddf3c473c8e7eb76e2137b9c9f6e18957ecba98321328572c259ad4a7804db7ddb2620a392c13622803cf623d24
SSDEEP 49152:zSij5xCxi91ZlQE98BXcwfQ20rfz2L3UhhuQpik0PXNATq8c2F:zSiP04Zebx0rfzAKke49G
TLSH
T1B836F13EE8728131E1A3CB35AF7F93E96D2535C03E9404025698591E3F39386725ABB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_2030ad089165675e54e6a9aaacf4f7326a0d107c04b7092cb415c44fdb8d8bd4.bin
- Size 4.9MB
- SHA256 2030ad089165675e54e6a9aaacf4f7326a0d107c04b7092cb415c44fdb8d8bd4
- MD5 01085e710f9534c0c14a1ba14b3892ce
- SHA1 c04f0e976064888c8c48f24afcc03861d95b6cba
- SHA512 e4b28d97c19af1b59563dcce779ddd6f53aa1ddf3c473c8e7eb76e2137b9c9f6e18957ecba98321328572c259ad4a7804db7ddb2620a392c13622803cf623d24
- SSDEEP 49152:zSij5xCxi91ZlQE98BXcwfQ20rfz2L3UhhuQpik0PXNATq8c2F:zSiP04Zebx0rfzAKke49G
- TLSH
  T1B836F13EE8728131E1A3CB35AF7F93E96D2535C03E9404025698591E3F39386725ABB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2