General
-
Target
download.txt
-
Size
27B
-
Sample
230408-b4rbbsdd41
-
MD5
e94a00363c4c886c9cc8e7193d956342
-
SHA1
19667b9ef43d509c3807b3887bd26cc6c9c825b5
-
SHA256
706a6ec9127dd25443833466eedebdb430f92a4b17160ed75c13183d6627ca59
-
SHA512
71bde0fedcbe29e8f7b99480f0b9ea9bfd681d7b74bbd5b488273b2b76b0662905a9c84c3a1211fa329c261aa41606c227bb4ff178926fe00314aa4fdaf12883
Static task
static1
Behavioral task
behavioral1
Sample
download.txt
Resource
win7-20230220-en
Malware Config
Extracted
gcleaner
85.31.45.39
85.31.45.250
85.31.45.251
85.31.45.88
Targets
-
-
Target
download.txt
-
Size
27B
-
MD5
e94a00363c4c886c9cc8e7193d956342
-
SHA1
19667b9ef43d509c3807b3887bd26cc6c9c825b5
-
SHA256
706a6ec9127dd25443833466eedebdb430f92a4b17160ed75c13183d6627ca59
-
SHA512
71bde0fedcbe29e8f7b99480f0b9ea9bfd681d7b74bbd5b488273b2b76b0662905a9c84c3a1211fa329c261aa41606c227bb4ff178926fe00314aa4fdaf12883
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Drops Chrome extension
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-