• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – RedLine Stealer – Active IOCs
January 3, 2023
Rewterz Threat Alert – AsyncRAT – Active IOCs
January 3, 2023

Rewterz Threat Alert – GCleaner Malware – Active IOCs

January 3, 2023

Severity

Medium

Analysis Summary

GCleaner is a tool that acts as a fake PC cleaner and is also known as Fake Garbage Cleaner. This tool was observed at the beginning of 2019 when executed it drops a Azorult Password straler. Moreover, the website implements a Traffic Direction System(TDS) using IPLogger which drops different malware including Azorult, PredatorTheThieff, and Miners depending on the location of the victim. To avoid the detection by Anti-virus they changed their technique by distributing these malware through crack websites. When these cracks are executed, it emits various payloads. Depending on the country it emits various malware which includes STOP/DJVU ransomware, SmokeLoader, Redline, Amadey, Flicker, and Racoon Stealer. The countries that were mostly targeted were the US, EU, and CA.

Impact

  • Information Theft
  • Credential Theft
  • Exposure of Sensitive Data

Indicators of Compromise

MD5

  • e7275c98baeec644557a29a205da9b67
  • 5d2f16ef266104387e196951e7a54383
  • e6db994994318206eff5a82324545b3e
  • 6f6c4d15d31224cc292b05a69f78e178
  • 50101e98e33d37f43dcef96003d56b36
  • 46c21a42e283c54c5f5934b60872bef3
  • 426f4f29514181a9f51151104ce2d6cd
  • 13f43881e6a011955b50c9e6bf6c7c7e
  • 5c0ca5ae09abe424a930dbabfcd1fbc0

SHA-256

  • d276c6dd3e341d814a4f6f95031c1feb020ed7f9f34508fc05b835aa9e67c261
  • a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39
  • df3a5dfe36eb2cbfc310116b48b98fc69cd558014c0ce40a4ea000b5ff6e21e6
  • 369098038281f7de6094bd9ac164f7ddd4aa445df37457d4e0cee03d9a6fb860
  • e8aacc014758fe6502f46e08a8e1abd3b5c1fdb4fa6f6c47596763dfd36fff8c
  • 2846006987a6aca3fed8047eb1366ff3666ff631f92d79690b69821e402a43b1
  • c9c68f9d0746eccdd0b556886e485553f9a3b11cd08f6f808fd12434231333c3
  • 65270c63dcea433a796178b20938418eafb1d0b31c7403057db9eb529e932bd9
  • bc2eff9f6234efcd11365832a4486d8946404d010e8ccd0316170cc8b1dd0c1f

SHA-1

  • ca95beb155f5013aceb85f4d2c2659c361ae36f3
  • 025c8f532bd1b3824730e2b110da6240fad56201
  • 408bea3ea1a62ceca765cd7883a8229f5f9f15ff
  • 22f50ea0eb07f941066210c48b45d796732f469d
  • c2a192a084c4dfe97c675931869f79b5ce1f62d4
  • afb42e28002c79b1ece29c7efa40ef470a3878d6
  • 35617affcdf9676bd0cef68104a5e01e652f77d7
  • 646b9a03721139c5bc156a84e73c250db68df9df
  • 01a2b88cefb4a8323b33169604b2f18b6ef5f5d9

Remediation

  • Block all threat indicators at your respective controls. 
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.