Overview

overview

10

Static

static

3

ded15c86cf...d7.exe

windows7-x64

10

ded15c86cf...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ded15c86cfa097278cdb1e06ccbfc265aaea47a44763fda139a90441ab70b3d7.exe

  • Size

    1.8MB

  • Sample

    250125-d4mdgstmhs

  • MD5

    49af6d6be38502c8a5564abcf39b052f

  • SHA1

    c6e07e1648d6c45c2b2abdaf38a8adb99c427f15

  • SHA256

    ded15c86cfa097278cdb1e06ccbfc265aaea47a44763fda139a90441ab70b3d7

  • SHA512

    43117a9e6d5f8df23311b9abf2babb9d35598a8e1d6a1e16f215c23c869b803522fb49867f1ea4c19c6f708e6af7590178c77d511cc4a6adda2b3e6a03c0cc09

  • SSDEEP

    49152:Z+wUSPUk/xGBWsmj4gDvhhnbrLl1Ioe+/59Oxd9:swUSPUaxGBBm9vHnbrfbeoK9

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      ded15c86cfa097278cdb1e06ccbfc265aaea47a44763fda139a90441ab70b3d7.exe

    • Size

      1.8MB

    • MD5

      49af6d6be38502c8a5564abcf39b052f

    • SHA1

      c6e07e1648d6c45c2b2abdaf38a8adb99c427f15

    • SHA256

      ded15c86cfa097278cdb1e06ccbfc265aaea47a44763fda139a90441ab70b3d7

    • SHA512

      43117a9e6d5f8df23311b9abf2babb9d35598a8e1d6a1e16f215c23c869b803522fb49867f1ea4c19c6f708e6af7590178c77d511cc4a6adda2b3e6a03c0cc09

    • SSDEEP

      49152:Z+wUSPUk/xGBWsmj4gDvhhnbrLl1Ioe+/59Oxd9:swUSPUaxGBBm9vHnbrfbeoK9

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks