Overview

overview

10

Static

static

3

0b6cb5ab11...3N.exe

windows7-x64

10

0b6cb5ab11...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b6cb5ab11c77ee4ecddc16151e4db51ce4f07cb923868517336b76cc9e42b93N.exe

  • Size

    1.8MB

  • Sample

    250101-xrtftaynfz

  • MD5

    983b07405bcef8fd2ecfde1da9c5e1c0

  • SHA1

    38b1b84e2b61ba04dfa7a9fe23901aa80cee25a0

  • SHA256

    0b6cb5ab11c77ee4ecddc16151e4db51ce4f07cb923868517336b76cc9e42b93

  • SHA512

    30c3aae432b476d5ab953f30aa1b8ab26b0aecf17873f05b59a108515120518f0b62d9e027867e11ee0ab6a71e4c148576e3f2bbe192dfed4592f7a8741f0a3d

  • SSDEEP

    49152:uMBpCTZ1bf5J2nI3A3OlhqSm7wqpv3oYTC16+q:uMCTjNYnR3Olh5mUqpvoYTD+q

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      0b6cb5ab11c77ee4ecddc16151e4db51ce4f07cb923868517336b76cc9e42b93N.exe

    • Size

      1.8MB

    • MD5

      983b07405bcef8fd2ecfde1da9c5e1c0

    • SHA1

      38b1b84e2b61ba04dfa7a9fe23901aa80cee25a0

    • SHA256

      0b6cb5ab11c77ee4ecddc16151e4db51ce4f07cb923868517336b76cc9e42b93

    • SHA512

      30c3aae432b476d5ab953f30aa1b8ab26b0aecf17873f05b59a108515120518f0b62d9e027867e11ee0ab6a71e4c148576e3f2bbe192dfed4592f7a8741f0a3d

    • SSDEEP

      49152:uMBpCTZ1bf5J2nI3A3OlhqSm7wqpv3oYTC16+q:uMCTjNYnR3Olh5mUqpvoYTD+q

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks