Overview

overview

10

Static

static

3

cb6b4bb0b3...bN.exe

windows7-x64

10

cb6b4bb0b3...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb6b4bb0b3fc19a3626bd33f40f4399e667db405f4ac56b69b2b271816df371bN.exe

  • Size

    1.8MB

  • Sample

    241226-jfrwyszmdy

  • MD5

    7d259326e9642c8a13d30573dafe3d90

  • SHA1

    fc5ba1d2215d2785b5223f501ce0254973adad2c

  • SHA256

    cb6b4bb0b3fc19a3626bd33f40f4399e667db405f4ac56b69b2b271816df371b

  • SHA512

    ddb2e84a2f3e88eda5f4c847a7bb836fc7eff26d6d47d5e74bc27180f6f346b78cb5d4aa35040b6be0f24e53651024ea59a9623f83c939762ccc216a567e4fbb

  • SSDEEP

    49152:tEUr5fRFAZmYEuoqNGsDfxOPfHzTOYsohE:t7BspoqppOPv/h

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      cb6b4bb0b3fc19a3626bd33f40f4399e667db405f4ac56b69b2b271816df371bN.exe

    • Size

      1.8MB

    • MD5

      7d259326e9642c8a13d30573dafe3d90

    • SHA1

      fc5ba1d2215d2785b5223f501ce0254973adad2c

    • SHA256

      cb6b4bb0b3fc19a3626bd33f40f4399e667db405f4ac56b69b2b271816df371b

    • SHA512

      ddb2e84a2f3e88eda5f4c847a7bb836fc7eff26d6d47d5e74bc27180f6f346b78cb5d4aa35040b6be0f24e53651024ea59a9623f83c939762ccc216a567e4fbb

    • SSDEEP

      49152:tEUr5fRFAZmYEuoqNGsDfxOPfHzTOYsohE:t7BspoqppOPv/h

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks