gcleaner | 926c3d8e5e2dddd788189ece888d503e4d97c65f22b9c00fb4d5c68445aa08b9

General

Target
jaffacakes118_926c3d8e5e2dddd788189ece888d503e4d97c65f22b9c00fb4d5c68445aa08b9.bin
Size 3.4MB
Sample260912-kda14avtes
SHA256 926c3d8e5e2dddd788189ece888d503e4d97c65f22b9c00fb4d5c68445aa08b9
MD5 dc9caef02d3bf11f140efda12f4690a3
SHA1 5f0116e551975008ee3411ad6f6a18992c33fbec
SHA512 b4f4935ddec4bda967ff60bee63ad755bd02b36622795829c42da613b02fb42cd9efd64f57a5e1c49c315262e8df3decac8e6ddadae05e46a26f8f40099e928f
SSDEEP 49152:BSyTuLGvbLVqwPs4SZqIm5EUzy0PRmZ5pvOhz99bBrtamxQX9Voe4oDIM:BSyTuSb84Q9qrZmZrAztaMQD54UIM
TLSH
T17FF5E0217163E57AF0A3A7349A3A1A58380539E33A3F85D75EDF1F301E2E5817B1E582
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

185.156.73.98
45.91.200.135

Targets

- Target
  jaffacakes118_926c3d8e5e2dddd788189ece888d503e4d97c65f22b9c00fb4d5c68445aa08b9.bin
- Size 3.4MB
- SHA256 926c3d8e5e2dddd788189ece888d503e4d97c65f22b9c00fb4d5c68445aa08b9
- MD5 dc9caef02d3bf11f140efda12f4690a3
- SHA1 5f0116e551975008ee3411ad6f6a18992c33fbec
- SHA512 b4f4935ddec4bda967ff60bee63ad755bd02b36622795829c42da613b02fb42cd9efd64f57a5e1c49c315262e8df3decac8e6ddadae05e46a26f8f40099e928f
- SSDEEP 49152:BSyTuLGvbLVqwPs4SZqIm5EUzy0PRmZ5pvOhz99bBrtamxQX9Voe4oDIM:BSyTuSb84Q9qrZmZrAztaMQD54UIM
- TLSH
  T17FF5E0217163E57AF0A3A7349A3A1A58380539E33A3F85D75EDF1F301E2E5817B1E582
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2