Overview

overview

10

Static

static

3

71dfdcc6b2...b0.exe

windows7-x64

10

71dfdcc6b2...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71dfdcc6b227bb689e98ac2c5f697b06e04129ad67526bb801b824e2e23c5cb0

  • Size

    1.8MB

  • Sample

    250115-c7hn2azner

  • MD5

    6d42cb2d907239f2c38c4b290419a09f

  • SHA1

    62334f22dcfdbe33ed3882d5ba7a941d5b2b770b

  • SHA256

    71dfdcc6b227bb689e98ac2c5f697b06e04129ad67526bb801b824e2e23c5cb0

  • SHA512

    b34b8b9cdfe4b848a5691c9dee507678296a835696a22b1900d3b61acdc477f854b0ab19edeb6cc9c717a78d26d7f1df3c6c5ee9368eeb968b350db48aa50c98

  • SSDEEP

    49152:sRW0nHZDHLTfKiV9OzISlFbZBzZYYNKNWav9vO:sRW0HZPTfzV9QFHzNNivY

Score
10/10
gcleanerdiscoveryevasionloader

Malware Config

Targets

    • Target

      71dfdcc6b227bb689e98ac2c5f697b06e04129ad67526bb801b824e2e23c5cb0

    • Size

      1.8MB

    • MD5

      6d42cb2d907239f2c38c4b290419a09f

    • SHA1

      62334f22dcfdbe33ed3882d5ba7a941d5b2b770b

    • SHA256

      71dfdcc6b227bb689e98ac2c5f697b06e04129ad67526bb801b824e2e23c5cb0

    • SHA512

      b34b8b9cdfe4b848a5691c9dee507678296a835696a22b1900d3b61acdc477f854b0ab19edeb6cc9c717a78d26d7f1df3c6c5ee9368eeb968b350db48aa50c98

    • SSDEEP

      49152:sRW0nHZDHLTfKiV9OzISlFbZBzZYYNKNWav9vO:sRW0HZPTfzV9QFHzNNivY

    Score
    10/10
    gcleanerdiscoveryevasionloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks