Overview

overview

10

Static

static

3

[VN][Studi...qZ.exe

windows7-x64

10

[VN][Studi...qZ.exe

windows10-2004-x64

8

_.exe

windows7-x64

3

_.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    XXX.zip

  • Size

    4.4MB

  • Sample

    230704-wgcjwahf3y

  • MD5

    66d98e6bd7e300d90067ddb122dc7807

  • SHA1

    95b297e343f88cef33094f0cb8651f6ba7d31cf9

  • SHA256

    758725808418413e65a4c5719c7c2a54ae9a8b720728ed3c33f28ac1b89ba1b0

  • SHA512

    10fc22e177de440507bf3e8b57d557357883f95f4320e661feb8abc0939f69af0be21c6bff1b0285b349e40fc638e5939dedcdb70a9300fb11e854530ab69c49

  • SSDEEP

    98304:HeRwVaqt7ABmfYFGtjIfn7q+eeXbbYbp6nKtCn+/7U8QIn:+RwBWBTpbkbQnKa+/BR

Score
10/10
gcleanerdiscoveryloaderupx

Malware Config

Targets

    • Target

      [VN][Studio-Miris][--Tb9oBdvAqZ.exe

    • Size

      4.3MB

    • MD5

      e065f90f418f0dccc24f3d3e7c1c536c

    • SHA1

      19d47888a88c043d86f3dc4792672af4d6bc6bb2

    • SHA256

      2b979114f7c15a76b2a9e94ba3c05514239eb9a9f4cb48dd056d08224e27d201

    • SHA512

      50df8deb32a2f0fc4aca3ea7bdfdbbd53fecb9fafcecd61ff36e09a8ad6fad5645f93fe8bed8b6398316247ecdf2fb991759bbba1a25490159ea05921684bf97

    • SSDEEP

      98304:eVe/itaC1fgJ8BOBGBfIHnfiEoyrxnurqVZJcv4ny/5cOQwt:p/iV01/pxur9vGy/vd

    Score
    10/10
    gcleanerdiscoveryloaderupx

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      _.exe

    • Size

      87KB

    • MD5

      a05a917f67edcba06cac9040f450a64b

    • SHA1

      0770b6d19d75d8bd201e720d2fa04d54ac3a3c9c

    • SHA256

      8a83d1b544aa4f22e53fdfc576561753b503558b4e0d529e160e56bc89326e9c

    • SHA512

      a048b16d940e029235fd83ffa1c4ccd8d9b07c066a1bae7f4caddc177ac690a8f73550e9468100a8b6ac168b3651e30355dd0861d925bd03f0f65c1552c970da

    • SSDEEP

      1536:vugkfdWgyjWHSGkJSm6h8N9d6tj89yYifnNs5IO4ixa:MWpWmJShh8N75PONsmO4j

    Score
    8/10

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks