Overview

overview

10

Static

static

3

cddb7a9001...d9.exe

windows7-x64

10

cddb7a9001...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cddb7a9001191fd69491aa7e2c5796db11893e8c5e783c421dc460275dfc85d9

  • Size

    1.8MB

  • Sample

    241231-pa8keazjgx

  • MD5

    29e8acff7db38be4a818d8ccb13dc7f4

  • SHA1

    a30c6dd2ab9d3339dcff66ca38ebfe12b6af4395

  • SHA256

    cddb7a9001191fd69491aa7e2c5796db11893e8c5e783c421dc460275dfc85d9

  • SHA512

    a051e62424756a1158a7ae437b072f36e2dc59bf93a06d9f62f4050d8f1c881b3300eda3117c2768ff1061f8c280b19ec737f93301304286e3696084268fd4a7

  • SSDEEP

    49152:zO/rAwqFs6BUYvf0eYOc04hq1A+PSyPR/VJntAi:zO/r8Vvf0NDqA0Jni

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      cddb7a9001191fd69491aa7e2c5796db11893e8c5e783c421dc460275dfc85d9

    • Size

      1.8MB

    • MD5

      29e8acff7db38be4a818d8ccb13dc7f4

    • SHA1

      a30c6dd2ab9d3339dcff66ca38ebfe12b6af4395

    • SHA256

      cddb7a9001191fd69491aa7e2c5796db11893e8c5e783c421dc460275dfc85d9

    • SHA512

      a051e62424756a1158a7ae437b072f36e2dc59bf93a06d9f62f4050d8f1c881b3300eda3117c2768ff1061f8c280b19ec737f93301304286e3696084268fd4a7

    • SSDEEP

      49152:zO/rAwqFs6BUYvf0eYOc04hq1A+PSyPR/VJntAi:zO/r8Vvf0NDqA0Jni

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks