Overview

overview

10

Static

static

3

346d3cdf5b...75.exe

windows7-x64

10

346d3cdf5b...75.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    346d3cdf5b336aa9a2ef25de7755bd565c18ee32cd9beae533b7228ad56a0c75

  • Size

    1.8MB

  • Sample

    250126-dawp3ayphw

  • MD5

    ede4e6608db70fec031ab05cd38ed127

  • SHA1

    c8f417fce7bc518df9a6a4a6503ea7ef3815a653

  • SHA256

    346d3cdf5b336aa9a2ef25de7755bd565c18ee32cd9beae533b7228ad56a0c75

  • SHA512

    84f9c12cd476649ad9a30364f86d18ab64063d92f55f3f9f52d8b881161bf015f6e517d49b4962336f8cc1ded435a540ebaef9b3f2d27cb9411583f754b41eb6

  • SSDEEP

    24576:JNd3yez03oEOoBjRrIpqi1jkc5cewR0BLpCkoxj280KYBc5WzPbi1pv967Pk4V3a:JHdCGfi0Oko9GNiBwBOXIgAgx+

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      346d3cdf5b336aa9a2ef25de7755bd565c18ee32cd9beae533b7228ad56a0c75

    • Size

      1.8MB

    • MD5

      ede4e6608db70fec031ab05cd38ed127

    • SHA1

      c8f417fce7bc518df9a6a4a6503ea7ef3815a653

    • SHA256

      346d3cdf5b336aa9a2ef25de7755bd565c18ee32cd9beae533b7228ad56a0c75

    • SHA512

      84f9c12cd476649ad9a30364f86d18ab64063d92f55f3f9f52d8b881161bf015f6e517d49b4962336f8cc1ded435a540ebaef9b3f2d27cb9411583f754b41eb6

    • SSDEEP

      24576:JNd3yez03oEOoBjRrIpqi1jkc5cewR0BLpCkoxj280KYBc5WzPbi1pv967Pk4V3a:JHdCGfi0Oko9GNiBwBOXIgAgx+

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks