gcleaner | f3b74aacbcccbffd2ab74fe78734e7f3e7689ddd140fa0bc44920911dd91b2ec

General

Target
jaffacakes118_f3b74aacbcccbffd2ab74fe78734e7f3e7689ddd140fa0bc44920911dd91b2ec.bin
Size 3.4MB
Sample260912-k971psek3y
SHA256 f3b74aacbcccbffd2ab74fe78734e7f3e7689ddd140fa0bc44920911dd91b2ec
MD5 ff3bb2b8106941d4f9b2eda077bdfc6b
SHA1 74be46f2bac7c01e2f503709ab1d0fe984e51505
SHA512 bd3cbed4254968900070d010c726a12ffac2edd39d9678c7bf570259b2612da3476638dbd5d190992502c489737c0e4836dd59fdb7e16689bf9e7b874f511edf
SSDEEP 49152:oSyTYxdt88EiXTaxmNKujIwbw/BmX78UsOnbVXy/1LWrrA2mCZ62I1:oSyTYxzSmIZUsObVWmrm+u
TLSH
T129F5F11AF2638676C0F2387476382175D41B3751AAFC987922834A77FFFD244A64E386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_f3b74aacbcccbffd2ab74fe78734e7f3e7689ddd140fa0bc44920911dd91b2ec.bin
- Size 3.4MB
- SHA256 f3b74aacbcccbffd2ab74fe78734e7f3e7689ddd140fa0bc44920911dd91b2ec
- MD5 ff3bb2b8106941d4f9b2eda077bdfc6b
- SHA1 74be46f2bac7c01e2f503709ab1d0fe984e51505
- SHA512 bd3cbed4254968900070d010c726a12ffac2edd39d9678c7bf570259b2612da3476638dbd5d190992502c489737c0e4836dd59fdb7e16689bf9e7b874f511edf
- SSDEEP 49152:oSyTYxdt88EiXTaxmNKujIwbw/BmX78UsOnbVXy/1LWrrA2mCZ62I1:oSyTYxzSmIZUsObVWmrm+u
- TLSH
  T129F5F11AF2638676C0F2387476382175D41B3751AAFC987922834A77FFFD244A64E386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2