Overview

overview

7

Static

static

3

GCLIENT.rar

windows7-x64

7

GCLIENT.rar

windows10-2004-x64

3

gcl/gclient.exe

windows7-x64

7

gcl/gclient.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/app-64.7z

windows7-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

3

LICENSE.electron.txt

windows7-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

chrome_100...nt.pak

windows7-x64

3

chrome_100...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows7-x64

3

chrome_200...nt.pak

windows10-2004-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

github.exe

windows7-x64

1

github.exe

windows10-2004-x64

7

icudtl.dat

windows7-x64

3

icudtl.dat

windows10-2004-x64

3

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

locales/af.pak

windows7-x64

3

locales/af.pak

windows10-2004-x64

3

locales/am.pak

windows7-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    GCLIENT.rar

  • Size

    65.8MB

  • Sample

    240604-13dfhsdb6t

  • MD5

    0fbf2f24c527b74928c0802f210fbd57

  • SHA1

    5174a8ce48353c1a34f0922d0c7a0b671d90b2f9

  • SHA256

    05fcb9ebcd239eaae4f76527366ac2fdcdd4d6d27ec7fc5a2c59c752a1b4880c

  • SHA512

    d8003cf68f9bf36eafcc617909a6b28bdf6c668a9c06ebbff1ed8e00cad1305f9ec1fa11786b0e953e645669d694fcb82e3851730591aefc2889f6aa61a6b79d

  • SSDEEP

    1572864:0rziNx5qdXsZYjwWiSU+7b+igvXTWYtTWoJbRVvLSZqP3AV+nkT7tpz/br:fx5qdXrjwIv3sfyqTzJbR1LQqIVwkT7v

Score
7/10
spywarestealer

Malware Config

Targets

    • Target

      GCLIENT.rar

    • Size

      65.8MB

    • MD5

      0fbf2f24c527b74928c0802f210fbd57

    • SHA1

      5174a8ce48353c1a34f0922d0c7a0b671d90b2f9

    • SHA256

      05fcb9ebcd239eaae4f76527366ac2fdcdd4d6d27ec7fc5a2c59c752a1b4880c

    • SHA512

      d8003cf68f9bf36eafcc617909a6b28bdf6c668a9c06ebbff1ed8e00cad1305f9ec1fa11786b0e953e645669d694fcb82e3851730591aefc2889f6aa61a6b79d

    • SSDEEP

      1572864:0rziNx5qdXsZYjwWiSU+7b+igvXTWYtTWoJbRVvLSZqP3AV+nkT7tpz/br:fx5qdXrjwIv3sfyqTzJbR1LQqIVwkT7v

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      gcl/gclient.exe

    • Size

      65.8MB

    • MD5

      f9ce7fcb106972ce8172ba33c615d578

    • SHA1

      9fe1e4a17248dfbf14339149ebc8b9744ec05738

    • SHA256

      b220e0e0dadc40d6c55f4de7c5a236ae15dceef5b2cc5c5a66ad38cd8665763b

    • SHA512

      86986e00b5b90cce866607a3037c48abc528ebce63b20fadb321383085d1bd4257e8ca45bec1887777824d5871bb1317a38655edb7c39ec04189429e0ab4aee3

    • SSDEEP

      1572864:MrziNx5qdXsZYjwWiSU+7b+igvXTWYtTWoJbRVvLSZqP3AV+nkT7tpz/b7:Hx5qdXrjwIv3sfyqTzJbR1LQqIVwkT7n

    Score
    7/10
    spywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/app-64.7z

    • Size

      65.5MB

    • MD5

      40437ba8e443e852c89cd6422b536ab4

    • SHA1

      54a78acefd9ae3101c257571f1aad48b5260527c

    • SHA256

      b93f1d159b2c1e2ac9dcacca6b46d0aba9758f10d76bf858a3b813d1325b2df2

    • SHA512

      26535d1405963c981633650b512501e8bcea723f590d28f552f0ab70d26e32bf89910264e0fbac7dba4cba674e0ce111e5cf82da664065b2a24e3b0997e98065

    • SSDEEP

      1572864:TrziNx5qdXsZYjwWiSU+7b+igvXTWYtTWoJbRVvLSZqP3AV+nkT7tpz/1:mx5qdXrjwIv3sfyqTzJbR1LQqIVwkT71

    Score
    3/10
    behavioral10behavioral9

    • Target

      LICENSE.electron.txt

    • Size

      1KB

    • MD5

      4d42118d35941e0f664dddbd83f633c5

    • SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    • SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    • SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    Score
    1/10
    behavioral11behavioral12

    • Target

      LICENSES.chromium.html

    • Size

      6.5MB

    • MD5

      180f8acc70405077badc751453d13625

    • SHA1

      35dc54acad60a98aeec47c7ade3e6a8c81f06883

    • SHA256

      0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c

    • SHA512

      40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec

    • SSDEEP

      24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj

    Score
    1/10
    behavioral13behavioral14

    • Target

      chrome_100_percent.pak

    • Size

      126KB

    • MD5

      8626e1d68e87f86c5b4dabdf66591913

    • SHA1

      4cd7b0ac0d3f72587708064a7b0a3beca3f7b81c

    • SHA256

      2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59

    • SHA512

      03bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99

    • SSDEEP

      3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2

    Score
    3/10
    behavioral15behavioral16

    • Target

      chrome_200_percent.pak

    • Size

      175KB

    • MD5

      48515d600258d60019c6b9c6421f79f6

    • SHA1

      0ef0b44641d38327a360aa6954b3b6e5aab2af16

    • SHA256

      07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce

    • SHA512

      b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9

    • SSDEEP

      3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR

    Score
    3/10
    behavioral17behavioral18

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      cb9807f6cf55ad799e920b7e0f97df99

    • SHA1

      bb76012ded5acd103adad49436612d073d159b29

    • SHA256

      5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

    • SHA512

      f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

    • SSDEEP

      49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI

    Score
    1/10
    behavioral19

    • Target

      ffmpeg.dll

    • Size

      2.7MB

    • MD5

      d49e7a8f096ad4722bd0f6963e0efc08

    • SHA1

      6835f12391023c0c7e3c8cc37b0496e3a93a5985

    • SHA256

      f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014

    • SHA512

      ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575

    • SSDEEP

      49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW

    Score
    1/10
    behavioral20behavioral21

    • Target

      github.exe

    • Size

      154.5MB

    • MD5

      c0f1ac85ffb6836e554e2f99065034ee

    • SHA1

      05292590f7af7e52e9c9cc05f7651def581d9d21

    • SHA256

      a43225829f8e0c2e5a46230994251c50be8c11520e87bdf021736e31696db79d

    • SHA512

      c711e0bfa75863d8843fdd3c417b2a6c765c6e8aa2d4bf4af38c9579c352f3bc1cbea9cf9176ced7136c7001ef937dafbce8568dad3b154dee62d8827cd63c93

    • SSDEEP

      1572864:uCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:UDAgZi

    Score
    7/10
    spywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral22behavioral23

    • Target

      icudtl.dat

    • Size

      10.1MB

    • MD5

      adfd2a259608207f256aeadb48635645

    • SHA1

      300bb0ae3d6b6514fb144788643d260b602ac6a4

    • SHA256

      7c8c7b05d70145120b45ccb64bf75bee3c63ff213e3e64d092d500a96afb8050

    • SHA512

      8397e74c7a85b0a2987cae9f2c66ce446923aa4140686d91a1e92b701e16b73a6ce459540e718858607ecb12659bedac0aa95c2713c811a2bc2d402691ff29dc

    • SSDEEP

      98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7

    Score
    3/10
    behavioral24behavioral25

    • Target

      libEGL.dll

    • Size

      468KB

    • MD5

      09134e6b407083baaedf9a8c0bce68f2

    • SHA1

      8847344cceeab35c1cdf8637af9bd59671b4e97d

    • SHA256

      d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577

    • SHA512

      6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba

    • SSDEEP

      12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX

    Score
    1/10
    behavioral26behavioral27

    • Target

      libGLESv2.dll

    • Size

      7.2MB

    • MD5

      a5f1921e6dcde9eaf42e2ccc82b3d353

    • SHA1

      1f6f4df99ae475acec4a7d3910badb26c15919d1

    • SHA256

      50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e

    • SHA512

      0c24ae7d75404adf8682868d0ebf05f02bbf603f7ddd177cf2af5726802d0a5afcf539dc5d68e10dab3fcfba58903871c9c81054560cf08799af1cc88f33c702

    • SSDEEP

      98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi

    Score
    1/10
    behavioral28behavioral29

    • Target

      locales/af.pak

    • Size

      353KB

    • MD5

      464e5eeaba5eff8bc93995ba2cb2d73f

    • SHA1

      3b216e0c5246c874ad0ad7d3e1636384dad2255d

    • SHA256

      0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1

    • SHA512

      726d6c41a9dbf1f5f2eff5b503ab68d879b088b801832c13fba7eb853302b16118cacda4748a4144af0f396074449245a42b2fe240429b1afcb7197fa0cb6d41

    • SSDEEP

      6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P

    Score
    3/10
    behavioral30behavioral31

    • Target

      locales/am.pak

    • Size

      569KB

    • MD5

      2c933f084d960f8094e24bee73fa826c

    • SHA1

      91dfddc2cff764275872149d454a8397a1a20ab1

    • SHA256

      fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450

    • SHA512

      3c9ecfb0407de2aa6585f4865ad54eeb2ec6519c9d346e2d33ed0e30be6cc3ebfed676a08637d42c2ca8fa6cfefb4091feb0c922ff71f09a2b89cdd488789774

    • SSDEEP

      12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0

    Score
    3/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

Score
7/10

behavioral2

Score
3/10

behavioral3

Score
7/10

behavioral4

spywarestealer
Score
7/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

spywarestealer
Score
7/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10