Extracted

• • Target
    793cc9134362162ac9d782e404c928e53ee3fb6cf728473561aab9e0db9beb96.exe
  • Size 933KB
  • SHA256 793cc9134362162ac9d782e404c928e53ee3fb6cf728473561aab9e0db9beb96
  • MD5 bd55d43e4d9b6744cb015a1bcb8194bf
  • SHA1 4bef3b38a43e0b6dfc2a425aa611eaa8e8715e16
  • SHA512 aa357ba568d881e4ab20af93b98c5a73d50480aaf86f0717508761f84f24c281ba91329e345be2ff1b810ef417d56822eae863deb8e2a03567898c6c79e54fcc
  • SSDEEP 12288:l8KmI/ZglLGRQVQYNc/qSsdMy6cyPYib49hX6G7oGUVicfPo3OqfYLaM0NMALFxs:1FOBVPNcLsivHiX6nTqfYglLL9E1t
  • TLSH
    T180157E62A3934433D1722A7D9C2B52649B2A7F036D37E54A27F40F482F3924D76363A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverygcleanerloaderprivilege_escalationcredential_accessspywarestealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Suspicious use of NtCreateProcessExOtherParentProcess

    defense_evasionprivilege_escalation

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2