Overview

overview

10

Static

static

3

047ce5d81b...f8.exe

windows7-x64

10

047ce5d81b...f8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    047ce5d81b7a837f67b4fcb38d0349691c4ae4b01e7186776af7049a61259df8

  • Size

    1.9MB

  • Sample

    250109-xzqpwszqhj

  • MD5

    afbc0ce691c7af4dc316ad0d8ac64c0b

  • SHA1

    98ed77db94e463abb9926fa398ca6f996496fa47

  • SHA256

    047ce5d81b7a837f67b4fcb38d0349691c4ae4b01e7186776af7049a61259df8

  • SHA512

    7fe1f937833508e6f0209c40da0a43aec3596ad919caf62c58ab71349c9e0f7df8e0575b2b905f24024fbc0c21f3d4b6dcfbe49d7f408ab4647b29c012635c0c

  • SSDEEP

    49152:gLY/PFof6Zhl53oc+YJl9vHquTNZDa4pScFUrMP:2GCwV3oc9ltTdRu

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      047ce5d81b7a837f67b4fcb38d0349691c4ae4b01e7186776af7049a61259df8

    • Size

      1.9MB

    • MD5

      afbc0ce691c7af4dc316ad0d8ac64c0b

    • SHA1

      98ed77db94e463abb9926fa398ca6f996496fa47

    • SHA256

      047ce5d81b7a837f67b4fcb38d0349691c4ae4b01e7186776af7049a61259df8

    • SHA512

      7fe1f937833508e6f0209c40da0a43aec3596ad919caf62c58ab71349c9e0f7df8e0575b2b905f24024fbc0c21f3d4b6dcfbe49d7f408ab4647b29c012635c0c

    • SSDEEP

      49152:gLY/PFof6Zhl53oc+YJl9vHquTNZDa4pScFUrMP:2GCwV3oc9ltTdRu

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks