Overview

overview

10

Static

static

3

19cf33f46e...b5.exe

windows7-x64

10

19cf33f46e...b5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19cf33f46e5db44e661dafc9dcb0f1d59d2fbf2cec54a85b4da9f5cfab662eb5.exe

  • Size

    1.8MB

  • Sample

    250102-avh3xsvpcn

  • MD5

    e331bf935845d52b1f11b3461103060f

  • SHA1

    3dc601a9770c07c7671c3429a24b89981b91b46b

  • SHA256

    19cf33f46e5db44e661dafc9dcb0f1d59d2fbf2cec54a85b4da9f5cfab662eb5

  • SHA512

    a6a38823f268d3af84ad240e9c903a84c3d1fc8f3e3065494901c5f1e732aaac91d0453671ed4c5eaef1e92aecd0c3edddf0165060cce6212e1daed4d2e6ffd9

  • SSDEEP

    49152:kl3cvjIA0Vw0YXydNo0FBcKSLsttxToYeY+tpGF1066:y3ujuw0CydNFvptfSiHN6

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      19cf33f46e5db44e661dafc9dcb0f1d59d2fbf2cec54a85b4da9f5cfab662eb5.exe

    • Size

      1.8MB

    • MD5

      e331bf935845d52b1f11b3461103060f

    • SHA1

      3dc601a9770c07c7671c3429a24b89981b91b46b

    • SHA256

      19cf33f46e5db44e661dafc9dcb0f1d59d2fbf2cec54a85b4da9f5cfab662eb5

    • SHA512

      a6a38823f268d3af84ad240e9c903a84c3d1fc8f3e3065494901c5f1e732aaac91d0453671ed4c5eaef1e92aecd0c3edddf0165060cce6212e1daed4d2e6ffd9

    • SSDEEP

      49152:kl3cvjIA0Vw0YXydNo0FBcKSLsttxToYeY+tpGF1066:y3ujuw0CydNFvptfSiHN6

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks