Overview

overview

10

Static

static

3

caa28b945b...a5.exe

windows7-x64

10

caa28b945b...a5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    caa28b945b443adf3f53432b46679d5bab488dfa5c49869c5c4cd3c428e26fa5.exe

  • Size

    1.8MB

  • Sample

    241230-yq1n6swnak

  • MD5

    86c0bb0df528e915974fde75dd60f613

  • SHA1

    4b664149aac5f36abf09a9db884808666437f6ea

  • SHA256

    caa28b945b443adf3f53432b46679d5bab488dfa5c49869c5c4cd3c428e26fa5

  • SHA512

    e2b5f8ae099b02231e4d5847965eaa03b41ae5a01ab42b4d0c4191cd1a41811b120be0d61c093c91386034e39ec90895e722bce32c97e6472c3ae51c874f4476

  • SSDEEP

    49152:VTL4Fkw4+fxjg0mjRakStRASAUnKzwHboIrCZsMPTq:d4Fkw4Yxjds18mQntfr2Pm

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      caa28b945b443adf3f53432b46679d5bab488dfa5c49869c5c4cd3c428e26fa5.exe

    • Size

      1.8MB

    • MD5

      86c0bb0df528e915974fde75dd60f613

    • SHA1

      4b664149aac5f36abf09a9db884808666437f6ea

    • SHA256

      caa28b945b443adf3f53432b46679d5bab488dfa5c49869c5c4cd3c428e26fa5

    • SHA512

      e2b5f8ae099b02231e4d5847965eaa03b41ae5a01ab42b4d0c4191cd1a41811b120be0d61c093c91386034e39ec90895e722bce32c97e6472c3ae51c874f4476

    • SSDEEP

      49152:VTL4Fkw4+fxjg0mjRakStRASAUnKzwHboIrCZsMPTq:d4Fkw4Yxjds18mQntfr2Pm

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks