gcleaner

General

Target
SecuriteInfo.com.Trojan.Inject5.57588.19464.25061.exe
Size 3.3MB
Sample250622-afsntaxxbt
SHA256 15a515744c599357ed3c534890753eb7d62930774d962c7936fc29ae5fa360b1
MD5 87804a67106d43c13906d08510045e64
SHA1 50c475d1bbc04dfa7f378225d539a0888ae8d2b1
SHA512 aa8c28e7729ac7f023e600514703e5898a4c3d39cc7bb6f871355a3b48bd1fdc6e3148d6787a63a752abc3afcadc93fca499014e9c997f472b5ccbe98bacaf6c
SSDEEP 49152:HvI8gzxo8g4lJ8VVqDBw3PmN04NVqUgmxWn7AfoIgC3JgV8+LIYNZWS/fqFu+5ej:PI8gnpOOYOJ00osySUJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

45.91.200.135

Targets

- Target
  SecuriteInfo.com.Trojan.Inject5.57588.19464.25061.exe
- Size 3.3MB
- SHA256 15a515744c599357ed3c534890753eb7d62930774d962c7936fc29ae5fa360b1
- MD5 87804a67106d43c13906d08510045e64
- SHA1 50c475d1bbc04dfa7f378225d539a0888ae8d2b1
- SHA512 aa8c28e7729ac7f023e600514703e5898a4c3d39cc7bb6f871355a3b48bd1fdc6e3148d6787a63a752abc3afcadc93fca499014e9c997f472b5ccbe98bacaf6c
- SSDEEP 49152:HvI8gzxo8g4lJ8VVqDBw3PmN04NVqUgmxWn7AfoIgC3JgV8+LIYNZWS/fqFu+5ej:PI8gnpOOYOJ00osySUJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gcleaner discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Gcleaner family

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2