Overview

overview

10

Static

static

3

5048a8bafe...a1.exe

windows7-x64

10

5048a8bafe...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5048a8bafeb30533d4815eb585458ee8da89e751a72194b888eecb007fe70ca1.exe

  • Size

    1.9MB

  • Sample

    250101-wb2xksyjgp

  • MD5

    8858c6f51feb9a25dc977456b614b779

  • SHA1

    8b1f8eb79cded1e839af975311590d02a49132cf

  • SHA256

    5048a8bafeb30533d4815eb585458ee8da89e751a72194b888eecb007fe70ca1

  • SHA512

    f387b554a7c5c5dd822556f86ac10d41a4d4548ff73c59263099484e4c6f53f2ef496bba229b2c423573521c4fd79a18e20f0e80dcca49df65fbc1877bdc8477

  • SSDEEP

    49152:7524FwArhlwPrUYfTKz9JTzssPsR8YkWPedazEBqZto3d211:755hiPwYbKRJTbqVkWWdaq3d2j

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      5048a8bafeb30533d4815eb585458ee8da89e751a72194b888eecb007fe70ca1.exe

    • Size

      1.9MB

    • MD5

      8858c6f51feb9a25dc977456b614b779

    • SHA1

      8b1f8eb79cded1e839af975311590d02a49132cf

    • SHA256

      5048a8bafeb30533d4815eb585458ee8da89e751a72194b888eecb007fe70ca1

    • SHA512

      f387b554a7c5c5dd822556f86ac10d41a4d4548ff73c59263099484e4c6f53f2ef496bba229b2c423573521c4fd79a18e20f0e80dcca49df65fbc1877bdc8477

    • SSDEEP

      49152:7524FwArhlwPrUYfTKz9JTzssPsR8YkWPedazEBqZto3d211:755hiPwYbKRJTbqVkWWdaq3d2j

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks