Overview

overview

10

Static

static

3

d0f6be0269...eN.exe

windows7-x64

10

d0f6be0269...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0f6be02693ce24bef596445de07e56513e4f11a75aab46112e45dab4cc4f91eN.exe

  • Size

    1.9MB

  • Sample

    250121-gzkwmszpct

  • MD5

    2c202230d3c909ec24e49fea6ead9590

  • SHA1

    4d414d9984c87a6c5a2da2bfadeeef9b058af827

  • SHA256

    d0f6be02693ce24bef596445de07e56513e4f11a75aab46112e45dab4cc4f91e

  • SHA512

    75545cd0e35b7a2a33c8de786a63cbbaabee2ae1137b02c421f30fa0ed9c90e2b1b97c493783594beb19a9b799b43875f1abfdd214b38efdbddd3392bddc7e55

  • SSDEEP

    49152:KYs2rGlafYVN+pXbIBRnWs1aDOLb0b6FEHunJ:56l82N+pX83nWs1ayLbkiEH

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      d0f6be02693ce24bef596445de07e56513e4f11a75aab46112e45dab4cc4f91eN.exe

    • Size

      1.9MB

    • MD5

      2c202230d3c909ec24e49fea6ead9590

    • SHA1

      4d414d9984c87a6c5a2da2bfadeeef9b058af827

    • SHA256

      d0f6be02693ce24bef596445de07e56513e4f11a75aab46112e45dab4cc4f91e

    • SHA512

      75545cd0e35b7a2a33c8de786a63cbbaabee2ae1137b02c421f30fa0ed9c90e2b1b97c493783594beb19a9b799b43875f1abfdd214b38efdbddd3392bddc7e55

    • SSDEEP

      49152:KYs2rGlafYVN+pXbIBRnWs1aDOLb0b6FEHunJ:56l82N+pX83nWs1ayLbkiEH

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks