Overview

overview

10

Static

static

3

212c64105b...70.exe

windows7-x64

10

212c64105b...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    212c64105bbcbac2d848baf2a9d0d002b141219ff9c2ee8647ec72b1c1f3bc70

  • Size

    1.8MB

  • Sample

    241227-sme1eawqfn

  • MD5

    4b28bc82a5e69ba553b5834d151d25a1

  • SHA1

    dd6f4755dec382f1e23f788a2283f11b87e28b24

  • SHA256

    212c64105bbcbac2d848baf2a9d0d002b141219ff9c2ee8647ec72b1c1f3bc70

  • SHA512

    9315ba6c9e29ba649ab29c5e6d1c71c21a3c14d3809e35d0f020642d2495d364ac9c3b2688126a69509c3fe501df7de35cc1e678357453c14bc67d9d5aa6b4dc

  • SSDEEP

    49152:EZu1yPIlzw5oCqEJ6HmHYUF5VeqtDItyWZIAAwPdUcN/m:EZ7PGwRqVHmHrGSDIUWgN+/

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      212c64105bbcbac2d848baf2a9d0d002b141219ff9c2ee8647ec72b1c1f3bc70

    • Size

      1.8MB

    • MD5

      4b28bc82a5e69ba553b5834d151d25a1

    • SHA1

      dd6f4755dec382f1e23f788a2283f11b87e28b24

    • SHA256

      212c64105bbcbac2d848baf2a9d0d002b141219ff9c2ee8647ec72b1c1f3bc70

    • SHA512

      9315ba6c9e29ba649ab29c5e6d1c71c21a3c14d3809e35d0f020642d2495d364ac9c3b2688126a69509c3fe501df7de35cc1e678357453c14bc67d9d5aa6b4dc

    • SSDEEP

      49152:EZu1yPIlzw5oCqEJ6HmHYUF5VeqtDItyWZIAAwPdUcN/m:EZ7PGwRqVHmHrGSDIUWgN+/

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks