Overview

overview

10

Static

static

3

HXEVX_file.exe

windows7-x64

10

HXEVX_file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HXEVX_file.exe

  • Size

    1.9MB

  • Sample

    241209-wx5wcswnh1

  • MD5

    f7a47830f40cc4b6a06d777fab2f42f9

  • SHA1

    5302227fbac3aea59d3aa18dc1e429ebe448c732

  • SHA256

    8a331ca76c2b919f30406ff66a92db0e27ae6af9725749a80959b42656871536

  • SHA512

    67251194db27bbb06cc3638c7fd453cc66f54b6e9aa1421cbd05ba5aa410f333b83f5587186bbd0b2026f05da1119eed68c8cfa64511b9c4d81d9a13d9634f1b

  • SSDEEP

    49152:pUoHhHRVeu+IIZoonat2m8GRMZpM0IKyNa:HHnVexGEg2mfMHDIR

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      HXEVX_file.exe

    • Size

      1.9MB

    • MD5

      f7a47830f40cc4b6a06d777fab2f42f9

    • SHA1

      5302227fbac3aea59d3aa18dc1e429ebe448c732

    • SHA256

      8a331ca76c2b919f30406ff66a92db0e27ae6af9725749a80959b42656871536

    • SHA512

      67251194db27bbb06cc3638c7fd453cc66f54b6e9aa1421cbd05ba5aa410f333b83f5587186bbd0b2026f05da1119eed68c8cfa64511b9c4d81d9a13d9634f1b

    • SSDEEP

      49152:pUoHhHRVeu+IIZoonat2m8GRMZpM0IKyNa:HHnVexGEg2mfMHDIR

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks