Extracted

• • Target
    file.exe
  • Size 648KB
  • SHA256 3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34
  • MD5 bfb8db9df49d8719b744321349af97b8
  • SHA1 800c890a3a8396c10ef8098886c6d8c46e594911
  • SHA512 b202f95a38391d5fac30e723f53d0e7a18776b54fd7427e9636249f31cd2412d7d26dd1646723bda93228a9f821ebec805aa3688d5a2a5e416beff9801ab58b3
  • SSDEEP 12288:S+DkHFnLCA5mXX0tEo8mB1tqGQ6vVIX1Ndkp2SgdMQ0NxL53284:JgZnU0tmEnvVIneB+M1w
  • TLSH
    T1BCE48E26B2E0E532D1631E388D5BE2799C3A7E413928986E2EE85D4C7F3464134673F7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiongcleanerloaderpersistenceprivilege_escalationspywarestealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2