gcleaner | a6d8777c50be43e82f0c0311a2d863a53f875abc3a612c4277af484be6981c77

General

Target
jaffacakes118_a6d8777c50be43e82f0c0311a2d863a53f875abc3a612c4277af484be6981c77.bin
Size 4.9MB
Sample260912-evy7csan8s
SHA256 a6d8777c50be43e82f0c0311a2d863a53f875abc3a612c4277af484be6981c77
MD5 51bc97fca1fbc5f95bfe39fdfbb4e5ee
SHA1 802e21aae3e7fbc6d435896bb37e62b9c0f5ab58
SHA512 bb2f519e3e851b08939c1b64270f51f0940c95209de3792a6254756d215d58d4e3883a7da7d95d3a56926d40c7762cebe3090dbffafa5c228ba2c7fd802ae218
SSDEEP 49152:0Sij5xB9HJ+brsV7YSp72qZgK540PL0YGNxXrJRvThd8sIVu5oErR2k4zbu:0SiP00V7l7Rs0PUx7JZTUsIyVv4zS
TLSH
T12836E035A5E18C36E0E31B7579AF23EA8D6879F54FB87C14EAC60C542936510E0B3F92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_a6d8777c50be43e82f0c0311a2d863a53f875abc3a612c4277af484be6981c77.bin
- Size 4.9MB
- SHA256 a6d8777c50be43e82f0c0311a2d863a53f875abc3a612c4277af484be6981c77
- MD5 51bc97fca1fbc5f95bfe39fdfbb4e5ee
- SHA1 802e21aae3e7fbc6d435896bb37e62b9c0f5ab58
- SHA512 bb2f519e3e851b08939c1b64270f51f0940c95209de3792a6254756d215d58d4e3883a7da7d95d3a56926d40c7762cebe3090dbffafa5c228ba2c7fd802ae218
- SSDEEP 49152:0Sij5xB9HJ+brsV7YSp72qZgK540PL0YGNxXrJRvThd8sIVu5oErR2k4zbu:0SiP00V7l7Rs0PUx7JZTUsIyVv4zS
- TLSH
  T12836E035A5E18C36E0E31B7579AF23EA8D6879F54FB87C14EAC60C542936510E0B3F92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2