Overview

overview

10

Static

static

3

8f8d1a9e7f...53.exe

windows7-x64

10

8f8d1a9e7f...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f8d1a9e7f37949080b154d202dafa653242b5549da8d0afbe387c885e599c53

  • Size

    1.8MB

  • Sample

    241226-3y297awjdn

  • MD5

    d0faf1e04aa82d9abc62d4e37f200f4f

  • SHA1

    302bbae50e0327a23a98ace9632a79c354673447

  • SHA256

    8f8d1a9e7f37949080b154d202dafa653242b5549da8d0afbe387c885e599c53

  • SHA512

    b03530c7d9165d67c4d1ccc7c999fa9c4ac43154f420f1b3827a373f1e71e2df5028791a5c94aa67889747ea67c9ac8c95b816fb572ec4d516cf602bbcba4ab5

  • SSDEEP

    49152:mUEcNdEkXBUOBCuEqWROQEMKWal2wjhu6sWv8YgR50P:mU3vEkZBCuEqWROQ2pl2wzpVeY

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      8f8d1a9e7f37949080b154d202dafa653242b5549da8d0afbe387c885e599c53

    • Size

      1.8MB

    • MD5

      d0faf1e04aa82d9abc62d4e37f200f4f

    • SHA1

      302bbae50e0327a23a98ace9632a79c354673447

    • SHA256

      8f8d1a9e7f37949080b154d202dafa653242b5549da8d0afbe387c885e599c53

    • SHA512

      b03530c7d9165d67c4d1ccc7c999fa9c4ac43154f420f1b3827a373f1e71e2df5028791a5c94aa67889747ea67c9ac8c95b816fb572ec4d516cf602bbcba4ab5

    • SSDEEP

      49152:mUEcNdEkXBUOBCuEqWROQEMKWal2wjhu6sWv8YgR50P:mU3vEkZBCuEqWROQ2pl2wzpVeY

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks