Overview

overview

10

Static

static

3

df4cf60301...ea.exe

windows7-x64

10

df4cf60301...ea.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df4cf60301112bafeeec91d2a67daa435640b2a3d9aabc135903768cd8c884ea

  • Size

    1.9MB

  • Sample

    241228-y6gw1askfl

  • MD5

    7fa63aaa2223ee5d43afd309cd5b76d4

  • SHA1

    023e257afa6dd90e83727ff5bc3a00825c16a34b

  • SHA256

    df4cf60301112bafeeec91d2a67daa435640b2a3d9aabc135903768cd8c884ea

  • SHA512

    5110b853fe4c1daa6861907330366148c43a78752f7803ee4016a2fb4b5da746437283a9ebf1051e91c01ec1ba05c9aba119f7b9f4831fe287b36c84bbb28385

  • SSDEEP

    49152:NtDBVZHIraEbkJlcadpbQNsntsiWUjbDkCWmSnL:NxhI+EY/pbQNWtsUjbDkCW

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      df4cf60301112bafeeec91d2a67daa435640b2a3d9aabc135903768cd8c884ea

    • Size

      1.9MB

    • MD5

      7fa63aaa2223ee5d43afd309cd5b76d4

    • SHA1

      023e257afa6dd90e83727ff5bc3a00825c16a34b

    • SHA256

      df4cf60301112bafeeec91d2a67daa435640b2a3d9aabc135903768cd8c884ea

    • SHA512

      5110b853fe4c1daa6861907330366148c43a78752f7803ee4016a2fb4b5da746437283a9ebf1051e91c01ec1ba05c9aba119f7b9f4831fe287b36c84bbb28385

    • SSDEEP

      49152:NtDBVZHIraEbkJlcadpbQNsntsiWUjbDkCWmSnL:NxhI+EY/pbQNWtsUjbDkCW

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks