gcleaner | 3b4bc633af4d5be9c0c004b72c8d50516e6020193dedaaeb6afb1174b7037c9c

General

Target
jaffacakes118_3b4bc633af4d5be9c0c004b72c8d50516e6020193dedaaeb6afb1174b7037c9c.bin
Size 3.3MB
Sample260912-k2aegavycv
SHA256 3b4bc633af4d5be9c0c004b72c8d50516e6020193dedaaeb6afb1174b7037c9c
MD5 4b7127a2f71f46ae4d3cb21c519fc6e2
SHA1 b3004d13470568d904b9216a0fa23cfd323debc9
SHA512 c526dc8068b78c5c1d6dcf1e04f00ca93b1cd35bdd5ba9763b58e6fca47027096316bda48ea2ecedb9cb4254b2e2a12de8bc463ce6d4b8600fc2031e591cfee5
SSDEEP 98304:XI8gggr4zpLoNRZd+JTlw8hdwDaeKe2VgLP:XnFpk/KBlw8hdwDHKe2uz
TLSH
T1BDF5F112E2661BBBDCA62B7F29267BF7E7C7B5633940704AF794380D3A725011C12663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_3b4bc633af4d5be9c0c004b72c8d50516e6020193dedaaeb6afb1174b7037c9c.bin
- Size 3.3MB
- SHA256 3b4bc633af4d5be9c0c004b72c8d50516e6020193dedaaeb6afb1174b7037c9c
- MD5 4b7127a2f71f46ae4d3cb21c519fc6e2
- SHA1 b3004d13470568d904b9216a0fa23cfd323debc9
- SHA512 c526dc8068b78c5c1d6dcf1e04f00ca93b1cd35bdd5ba9763b58e6fca47027096316bda48ea2ecedb9cb4254b2e2a12de8bc463ce6d4b8600fc2031e591cfee5
- SSDEEP 98304:XI8gggr4zpLoNRZd+JTlw8hdwDaeKe2VgLP:XnFpk/KBlw8hdwDHKe2uz
- TLSH
  T1BDF5F112E2661BBBDCA62B7F29267BF7E7C7B5633940704AF794380D3A725011C12663
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2