Overview

overview

10

Static

static

3

687b552b7e...6e.exe

windows7-x64

10

687b552b7e...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    687b552b7ea349c3a446bb15dbe295cd00545c8b874465987508e25bb62d526e

  • Size

    1.8MB

  • Sample

    250125-2f2p9ssmhz

  • MD5

    bb3b707ceac943b04c0990783e1626d4

  • SHA1

    cef9f07cd7ec9b1d19014245b176fd71daf0c9c0

  • SHA256

    687b552b7ea349c3a446bb15dbe295cd00545c8b874465987508e25bb62d526e

  • SHA512

    66e5421a344be0d2e79280e8eb40b47d014746f567f17d565a87da0d8fcd95a349d49ee31f81b8df242c5e3fc4d6db9932968ffbd2c33022e7ff1f471ba32129

  • SSDEEP

    49152:mvb5m4laPpyHyp/Dx/d3tB3nomv8d9UfbuNTtN9o:mvkmocH4/NDomvSyzaTt8

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      687b552b7ea349c3a446bb15dbe295cd00545c8b874465987508e25bb62d526e

    • Size

      1.8MB

    • MD5

      bb3b707ceac943b04c0990783e1626d4

    • SHA1

      cef9f07cd7ec9b1d19014245b176fd71daf0c9c0

    • SHA256

      687b552b7ea349c3a446bb15dbe295cd00545c8b874465987508e25bb62d526e

    • SHA512

      66e5421a344be0d2e79280e8eb40b47d014746f567f17d565a87da0d8fcd95a349d49ee31f81b8df242c5e3fc4d6db9932968ffbd2c33022e7ff1f471ba32129

    • SSDEEP

      49152:mvb5m4laPpyHyp/Dx/d3tB3nomv8d9UfbuNTtN9o:mvkmocH4/NDomvSyzaTt8

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks