gcleaner | bb2ad12694df59c070685fa60bf69f67b78f981d160ed8f376eb830b19cd88d8

General

Target
jaffacakes118_bb2ad12694df59c070685fa60bf69f67b78f981d160ed8f376eb830b19cd88d8.bin
Size 3.2MB
Sample260912-h66bla1end
SHA256 bb2ad12694df59c070685fa60bf69f67b78f981d160ed8f376eb830b19cd88d8
MD5 66e41af27d1c2ab010cf98527d628608
SHA1 a5436dfe961c655425233ef768f0d3c4067a3213
SHA512 e17ad2c74378593ce32db55ed4d44ae2ce5868db2c66eb2fcc74672eea0dba5f6a180df48adca5e7024315284ba4a3c3f253f1b6806ff3816eb39e7e669d0fc7
SSDEEP 98304:rl+xdpYiIIJjZdDAilEpUQq8HM5jEY9W5fOq:rl+vpYiVZdF+59HM5jETfOq
TLSH
T1A7E5026E8DE25532F3E353FBCB0ED1B995B92551291C84D98993FE036A201C5F86B233
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_bb2ad12694df59c070685fa60bf69f67b78f981d160ed8f376eb830b19cd88d8.bin
- Size 3.2MB
- SHA256 bb2ad12694df59c070685fa60bf69f67b78f981d160ed8f376eb830b19cd88d8
- MD5 66e41af27d1c2ab010cf98527d628608
- SHA1 a5436dfe961c655425233ef768f0d3c4067a3213
- SHA512 e17ad2c74378593ce32db55ed4d44ae2ce5868db2c66eb2fcc74672eea0dba5f6a180df48adca5e7024315284ba4a3c3f253f1b6806ff3816eb39e7e669d0fc7
- SSDEEP 98304:rl+xdpYiIIJjZdDAilEpUQq8HM5jEY9W5fOq:rl+vpYiVZdF+59HM5jETfOq
- TLSH
  T1A7E5026E8DE25532F3E353FBCB0ED1B995B92551291C84D98993FE036A201C5F86B233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2