Rewterz Threat Alert – GCleaner Malware – Active IOCs

Severity

Medium

Analysis Summary

GCleaner is a tool that acts as a fake PC cleaner and is also known as Fake Garbage Cleaner. This tool was observed at the beginning of 2019 when executed it drops a Azorult Password straler. Moreover, the website implements a Traffic Direction System(TDS) using IPLogger which drops different malware including Azorult, PredatorTheThieff, and Miners depending on the location of the victim. To avoid the detection by Anti-virus they changed their technique by distributing these malware through crack websites. When these cracks are executed, it emits various payloads. Depending on the country it emits various malware which includes STOP/DJVU ransomware, SmokeLoader, Redline, Amadey, Flicker, and Racoon Stealer. The countries that were mostly targeted were the US, EU, and CA.

Impact

• Information Theft
• Credential Theft
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• e7275c98baeec644557a29a205da9b67
• 5d2f16ef266104387e196951e7a54383
• e6db994994318206eff5a82324545b3e
• 6f6c4d15d31224cc292b05a69f78e178
• 50101e98e33d37f43dcef96003d56b36
• 46c21a42e283c54c5f5934b60872bef3
• 426f4f29514181a9f51151104ce2d6cd
• 13f43881e6a011955b50c9e6bf6c7c7e
• 5c0ca5ae09abe424a930dbabfcd1fbc0

SHA-256

• d276c6dd3e341d814a4f6f95031c1feb020ed7f9f34508fc05b835aa9e67c261
• a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39
• df3a5dfe36eb2cbfc310116b48b98fc69cd558014c0ce40a4ea000b5ff6e21e6
• 369098038281f7de6094bd9ac164f7ddd4aa445df37457d4e0cee03d9a6fb860
• e8aacc014758fe6502f46e08a8e1abd3b5c1fdb4fa6f6c47596763dfd36fff8c
• 2846006987a6aca3fed8047eb1366ff3666ff631f92d79690b69821e402a43b1
• c9c68f9d0746eccdd0b556886e485553f9a3b11cd08f6f808fd12434231333c3
• 65270c63dcea433a796178b20938418eafb1d0b31c7403057db9eb529e932bd9
• bc2eff9f6234efcd11365832a4486d8946404d010e8ccd0316170cc8b1dd0c1f

SHA-1

• ca95beb155f5013aceb85f4d2c2659c361ae36f3
• 025c8f532bd1b3824730e2b110da6240fad56201
• 408bea3ea1a62ceca765cd7883a8229f5f9f15ff
• 22f50ea0eb07f941066210c48b45d796732f469d
• c2a192a084c4dfe97c675931869f79b5ce1f62d4
• afb42e28002c79b1ece29c7efa40ef470a3878d6
• 35617affcdf9676bd0cef68104a5e01e652f77d7
• 646b9a03721139c5bc156a84e73c250db68df9df
• 01a2b88cefb4a8323b33169604b2f18b6ef5f5d9

Remediation

• Block all threat indicators at your respective controls. 
• Search for IOCs in your environment.