gcleaner | 6cd1b1a0324ed4956844c6a7767d860de10aeba01e3e897518ceb2409e77e3b6

General

Target
jaffacakes118_6cd1b1a0324ed4956844c6a7767d860de10aeba01e3e897518ceb2409e77e3b6.bin
Size 4.7MB
Sample260912-gbn86aea67
SHA256 6cd1b1a0324ed4956844c6a7767d860de10aeba01e3e897518ceb2409e77e3b6
MD5 ea2ed85fdc291bb04bb2da4dc797ff90
SHA1 e66533eac3aa97e2d76cb91615f824226006b5a1
SHA512 03a5c84e346341478f33e6a882bb56f3f6415624acb5acdbb62466f6e9bfc3d8c47738da24d61868b894e8cca91d88aba705365f4bbcd6ce4fb4ded4acb9e725
SSDEEP 98304:GJsQekaI3JHx6liFRGn33U+JvXhocZc3dn5b:GJ1XJHii4k6JUh5b
TLSH
T19036E17FB3B026FEC6E32D38587B769073247B750C6969420FAA7901B6F9B839911143
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_6cd1b1a0324ed4956844c6a7767d860de10aeba01e3e897518ceb2409e77e3b6.bin
- Size 4.7MB
- SHA256 6cd1b1a0324ed4956844c6a7767d860de10aeba01e3e897518ceb2409e77e3b6
- MD5 ea2ed85fdc291bb04bb2da4dc797ff90
- SHA1 e66533eac3aa97e2d76cb91615f824226006b5a1
- SHA512 03a5c84e346341478f33e6a882bb56f3f6415624acb5acdbb62466f6e9bfc3d8c47738da24d61868b894e8cca91d88aba705365f4bbcd6ce4fb4ded4acb9e725
- SSDEEP 98304:GJsQekaI3JHx6liFRGn33U+JvXhocZc3dn5b:GJ1XJHii4k6JUh5b
- TLSH
  T19036E17FB3B026FEC6E32D38587B769073247B750C6969420FAA7901B6F9B839911143
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2