General

  • Target

    5f9fca740396ba14711a1b715aa611ed17fc2f833ae15c2ac582fbda3b2246d7

  • Size

    393KB

  • Sample

    240625-ygys8aygka

  • MD5

    24da98fdaea0c10333d7e76961364b8b

  • SHA1

    51b07f1d4f0bc033f01a080bf8a223e25ab01096

  • SHA256

    5f9fca740396ba14711a1b715aa611ed17fc2f833ae15c2ac582fbda3b2246d7

  • SHA512

    ef7ea515cfb1c694a26e557adf2dff8f27c88eafef7d145f6b377419e62591a0b962feda5cb72db48384260dd03dc4d3f430d1f0e9bd6096a5b004bf55f71463

  • SSDEEP

    6144:SLoMkVriKlRdB9TImCYNPKrhOJxKK9I35coVK84Nz:ScMUrz1B924PK1OJxKKuGoEbN

Score
10/10

Malware Config

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

185.172.128.69

Targets

    • Target

      5f9fca740396ba14711a1b715aa611ed17fc2f833ae15c2ac582fbda3b2246d7

    • Size

      393KB

    • MD5

      24da98fdaea0c10333d7e76961364b8b

    • SHA1

      51b07f1d4f0bc033f01a080bf8a223e25ab01096

    • SHA256

      5f9fca740396ba14711a1b715aa611ed17fc2f833ae15c2ac582fbda3b2246d7

    • SHA512

      ef7ea515cfb1c694a26e557adf2dff8f27c88eafef7d145f6b377419e62591a0b962feda5cb72db48384260dd03dc4d3f430d1f0e9bd6096a5b004bf55f71463

    • SSDEEP

      6144:SLoMkVriKlRdB9TImCYNPKrhOJxKK9I35coVK84Nz:ScMUrz1B924PK1OJxKKuGoEbN

    Score
    10/10
    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks