gcleaner | 0f7b8eac452fce87bee69a79c368bf805e8d23c9adaeba963e071b3355bbe6d7

General

Target
jaffacakes118_0f7b8eac452fce87bee69a79c368bf805e8d23c9adaeba963e071b3355bbe6d7.bin
Size 3.2MB
Sample260912-g9nqaack3y
SHA256 0f7b8eac452fce87bee69a79c368bf805e8d23c9adaeba963e071b3355bbe6d7
MD5 ba01c94fab9e266fe6693d52c6176a7e
SHA1 146115b7d0cd23dfb679a168e165e52378c6a1d8
SHA512 bcea7b044e9bdd780103648e54cad64af7473bfef22ce1d07207637cf82f96790fa6885cc0c59bc985bf69f6f4874d3bf2e3e2afff4c7d9c1f5669ff0532d660
SSDEEP 49152:1zxyKgsxHx+n9hccT0SjKE2ub2MLmGvH69lWIAH0tMMYAyMz5QiiwqXYzDXXz/SP:1zxywxH8ltjb1P+AoFYAyMtQDXMHz/SP
TLSH
T150F5F01E9E48AC36C67613387CFBB2707239ED12492E7E7637A42908BD8025275673DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_0f7b8eac452fce87bee69a79c368bf805e8d23c9adaeba963e071b3355bbe6d7.bin
- Size 3.2MB
- SHA256 0f7b8eac452fce87bee69a79c368bf805e8d23c9adaeba963e071b3355bbe6d7
- MD5 ba01c94fab9e266fe6693d52c6176a7e
- SHA1 146115b7d0cd23dfb679a168e165e52378c6a1d8
- SHA512 bcea7b044e9bdd780103648e54cad64af7473bfef22ce1d07207637cf82f96790fa6885cc0c59bc985bf69f6f4874d3bf2e3e2afff4c7d9c1f5669ff0532d660
- SSDEEP 49152:1zxyKgsxHx+n9hccT0SjKE2ub2MLmGvH69lWIAH0tMMYAyMz5QiiwqXYzDXXz/SP:1zxywxH8ltjb1P+AoFYAyMtQDXMHz/SP
- TLSH
  T150F5F01E9E48AC36C67613387CFBB2707239ED12492E7E7637A42908BD8025275673DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2