General

  • Target

    92d8874c9bccf6efe5794d190c6f0aae.bin

  • Size

    401KB

  • Sample

    230206-lpb8zadc45

  • MD5

    4eef5c3c5a5502caa1d27cee5640c215

  • SHA1

    1a6e95bb5b6a00a7c204aaf73d8323cd939652f4

  • SHA256

    070376078ab0b6c5310ebb69e7a1eec11626113f46101e87e482b3bdf2e8e7ca

  • SHA512

    077d8e9b40e01753dd022126c2e8a7b39a986db831beda0658941537cd71375cc1361e0843f10e726fe755ca3f8ff2335bea310a69d49cf6c416fa46c6d69d09

  • SSDEEP

    12288:TblFziLIeDxB3khD12oCgBv6GesAy8YaVAplAGfOaMLm:rz7ev0hoYNesQnVApNfLf

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Targets

    • Target

      8bb65de7a3ac7c7cdf84ff44b3e09ea54ed7e38dde63a886b4c04321dcfe2402.exe

    • Size

      758KB

    • MD5

      92d8874c9bccf6efe5794d190c6f0aae

    • SHA1

      644a860909f12dde66cdc9e6e1fb574f5114a106

    • SHA256

      8bb65de7a3ac7c7cdf84ff44b3e09ea54ed7e38dde63a886b4c04321dcfe2402

    • SHA512

      200c9271e2268e8231c2c64c6f418aba06eacecfc58376741e14415f1dafe45b204deb76fb411702189a4f57c25c0689453aaca664c819ddc3346d71c1b09f36

    • SSDEEP

      12288:VQi3pRnv6m6URA3Phfgp1hf39Wkv8xwJiWt6uIn:VQiZZChh4pdUMic6uY

    • Detect rhadamanthys stealer shellcode

    • Detects LgoogLoader payload

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • LgoogLoader

      A downloader capable of dropping and executing other malware families.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks