gcleaner | aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 01:21

Target

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
Size

399KB
MD5

1176eddcbf25be2d6f06c21b3b40b755
SHA1

23188a80c906942d357f8bb2660e9061e933786d
SHA256

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad
SHA512

eec48e24cd338731b8f5f5e1aebbf33ec3df8ff47db4994e4781580a9fc7462b70de7948b1c81876d6a34ab4f56cb3821a3784afde2a3005eef30f548b501ee3
SSDEEP

6144:DqLTSRU7j5Byw9oF0VYz5cti3LuQMTIWt:2/yU7j5bgNz2i3KQMT

Score

10^/10

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid process

1712 aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

pid	process
1712	aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe

C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe
"C:\Users\Admin\AppData\Local\Temp\aae84a3974094ccb8fc0cfbbfe65deab223f77126819da3d60788533c0dff7ad.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1712

memory/1712-1-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/1712-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1712-2-0x00000000003C0000-0x00000000003FC000-memory.dmp

Filesize
240KB

Download
memory/1712-4-0x0000000000400000-0x0000000002380000-memory.dmp

Filesize
31.5MB

Download
memory/1712-6-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/1712-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download