Overview

overview

10

Static

static

3

9aa29c004b...af.exe

windows7-x64

10

9aa29c004b...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9aa29c004b21c8589893f34ecca4c39150caa55320264a7bd2318c6b957e37af

  • Size

    1.8MB

  • Sample

    250126-1lb65awngp

  • MD5

    c90ce771ef83231b8cec1b684ecee639

  • SHA1

    6818a9d4919dff1ad63aa5f05a0e5bf3b6b33205

  • SHA256

    9aa29c004b21c8589893f34ecca4c39150caa55320264a7bd2318c6b957e37af

  • SHA512

    cb9f49ce1fa221ff60f8b47e5934ddc1fe717c7fa0e0a1f7fa559356626cb964dac38970e14a6beb3a390b90f304586714dbf0ba1cd36807aa90fe4aeb5cef73

  • SSDEEP

    49152:prYH694jESHKqE4V3X1XL/62vTBy1UwYNsb6EvCj7r:tYa9PKV3X1bS2vOUra

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      9aa29c004b21c8589893f34ecca4c39150caa55320264a7bd2318c6b957e37af

    • Size

      1.8MB

    • MD5

      c90ce771ef83231b8cec1b684ecee639

    • SHA1

      6818a9d4919dff1ad63aa5f05a0e5bf3b6b33205

    • SHA256

      9aa29c004b21c8589893f34ecca4c39150caa55320264a7bd2318c6b957e37af

    • SHA512

      cb9f49ce1fa221ff60f8b47e5934ddc1fe717c7fa0e0a1f7fa559356626cb964dac38970e14a6beb3a390b90f304586714dbf0ba1cd36807aa90fe4aeb5cef73

    • SSDEEP

      49152:prYH694jESHKqE4V3X1XL/62vTBy1UwYNsb6EvCj7r:tYa9PKV3X1bS2vOUra

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks