Overview

overview

10

Static

static

3

576995fdab...b3.exe

windows7-x64

10

576995fdab...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    576995fdabc848ae46b6e948a29d241d6bf7f84de17bdb70f38c050b56d57eb3

  • Size

    1.8MB

  • Sample

    250125-w9jtnavrcz

  • MD5

    d7f9075b2bc8d7fdc7e9c74b64bcc22d

  • SHA1

    30dc79a5a7380f289066e160809faaba1aa21b8f

  • SHA256

    576995fdabc848ae46b6e948a29d241d6bf7f84de17bdb70f38c050b56d57eb3

  • SHA512

    31ae31847ae8628d120b2ddc56afba8dc57f23d176e01ba02866cf8cae23ff178ed0204cd780c8c4c2ac860e1c3f6f5f7aa3b282406db0988eac5c57c1457175

  • SSDEEP

    49152:KEjU5Hg26ap8CkrSyVxuRopMKk2Cx0pUI:BU5Hr6ap8CkOyVxuSZk2Yx

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      576995fdabc848ae46b6e948a29d241d6bf7f84de17bdb70f38c050b56d57eb3

    • Size

      1.8MB

    • MD5

      d7f9075b2bc8d7fdc7e9c74b64bcc22d

    • SHA1

      30dc79a5a7380f289066e160809faaba1aa21b8f

    • SHA256

      576995fdabc848ae46b6e948a29d241d6bf7f84de17bdb70f38c050b56d57eb3

    • SHA512

      31ae31847ae8628d120b2ddc56afba8dc57f23d176e01ba02866cf8cae23ff178ed0204cd780c8c4c2ac860e1c3f6f5f7aa3b282406db0988eac5c57c1457175

    • SSDEEP

      49152:KEjU5Hg26ap8CkrSyVxuRopMKk2Cx0pUI:BU5Hr6ap8CkOyVxuSZk2Yx

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks