Overview

overview

10

Static

static

3

be75c0b0db...b8.exe

windows7-x64

10

be75c0b0db...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be75c0b0db67c5164e50d596e6af98663d94efc0c9adc94edd6c55b2db2c6bb8

  • Size

    1.9MB

  • Sample

    250108-h94beaskhl

  • MD5

    b267a114da92ecf0ea4aa3ead1fd801b

  • SHA1

    7460c6556b9cad19244c3dab079e22c8cc0f62f3

  • SHA256

    be75c0b0db67c5164e50d596e6af98663d94efc0c9adc94edd6c55b2db2c6bb8

  • SHA512

    a014e5b304facf75a994a30af2d77a002dedeb56369dadca6ba00181c720f3a48ce7688740505ee66453598375ed8ff065900417a241a988a69c7e434224b9f5

  • SSDEEP

    49152:7s29yBE+exkbdAn3q4K2NuYirDX/X2w6I7JvSI:gFCrpn3NwYi3P2/IVq

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      be75c0b0db67c5164e50d596e6af98663d94efc0c9adc94edd6c55b2db2c6bb8

    • Size

      1.9MB

    • MD5

      b267a114da92ecf0ea4aa3ead1fd801b

    • SHA1

      7460c6556b9cad19244c3dab079e22c8cc0f62f3

    • SHA256

      be75c0b0db67c5164e50d596e6af98663d94efc0c9adc94edd6c55b2db2c6bb8

    • SHA512

      a014e5b304facf75a994a30af2d77a002dedeb56369dadca6ba00181c720f3a48ce7688740505ee66453598375ed8ff065900417a241a988a69c7e434224b9f5

    • SSDEEP

      49152:7s29yBE+exkbdAn3q4K2NuYirDX/X2w6I7JvSI:gFCrpn3NwYi3P2/IVq

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks