gcleaner | 674e5b2a6e52de038ac8b0e7036e34180ddbeed098013d3aac234af8c69cb4cd

General

Target
2026-11-10_a1307d785d136cd80aa3139998be3e20_amadey_elex_mespinoza_remcos_smoke-loader
Size 430KB
Sample261112-ankyyacz4p
SHA256 674e5b2a6e52de038ac8b0e7036e34180ddbeed098013d3aac234af8c69cb4cd
MD5 a1307d785d136cd80aa3139998be3e20
SHA1 76c5a481450af7968c26ee48e651c90208621e64
SHA512 796cfdb56c68583da27e9a741ab012aeaf1b6d4fbfb5756d532eb096b39e330194d83ecb810f4dfbdc54626c9e6f62ac1293aca15673a56eac0bf006517a65b7
SSDEEP 6144:2LsytEb2gNxOgV/oZ/UwqNCvmCHHRfQnWWJkwbUOqGWsxmtBCmr:2LsytEb20xX214C+3nBJkwbUOqGMl
TLSH
T1FC94AE10B7A0C03DF0B222F87971A765A53B7DE1AB3491CB62D52AEE5A346D0EC70753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

gcl-gb.biz

Targets

- Target
  2026-11-10_a1307d785d136cd80aa3139998be3e20_amadey_elex_mespinoza_remcos_smoke-loader
- Size 430KB
- SHA256 674e5b2a6e52de038ac8b0e7036e34180ddbeed098013d3aac234af8c69cb4cd
- MD5 a1307d785d136cd80aa3139998be3e20
- SHA1 76c5a481450af7968c26ee48e651c90208621e64
- SHA512 796cfdb56c68583da27e9a741ab012aeaf1b6d4fbfb5756d532eb096b39e330194d83ecb810f4dfbdc54626c9e6f62ac1293aca15673a56eac0bf006517a65b7
- SSDEEP 6144:2LsytEb2gNxOgV/oZ/UwqNCvmCHHRfQnWWJkwbUOqGWsxmtBCmr:2LsytEb20xX214C+3nBJkwbUOqGMl
- TLSH
  T1FC94AE10B7A0C03DF0B222F87971A765A53B7DE1AB3491CB62D52AEE5A346D0EC70753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gcleaner onlylogger loader
- Family: GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Family: OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- OnlyLogger payload
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: GCleaner

Family: OnlyLogger

OnlyLogger payload

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2