Overview

overview

10

Static

static

3

5273e27828...bc.exe

windows7-x64

10

5273e27828...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5273e278285b17a6c6427fee35a7a8b9453326b85c8f6849f29f3131663eeebc

  • Size

    1.9MB

  • Sample

    250126-jfcr2awlcz

  • MD5

    d247a6a9222ddf433a1d8f3f425ce9bc

  • SHA1

    d52889badeeb99025cfe066965f890f0f2fed680

  • SHA256

    5273e278285b17a6c6427fee35a7a8b9453326b85c8f6849f29f3131663eeebc

  • SHA512

    515d7b1aa7da3f06cad495c74ef0f930a698c0f189d305ccef7ef9e3dce9e25d40fb757349d85837523b7c0a3dc7def5ccd826b8b8c26037a28e98c761b0441b

  • SSDEEP

    24576:XxytKBYLie79KaVrR9zfQ4WFYrwyIGyAuajUdVeQ0dtmDoJXxfnsEYwRhikcm9Xi:XRYLtUaVrbD3rwLJawe9ftnLveN6Km

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      5273e278285b17a6c6427fee35a7a8b9453326b85c8f6849f29f3131663eeebc

    • Size

      1.9MB

    • MD5

      d247a6a9222ddf433a1d8f3f425ce9bc

    • SHA1

      d52889badeeb99025cfe066965f890f0f2fed680

    • SHA256

      5273e278285b17a6c6427fee35a7a8b9453326b85c8f6849f29f3131663eeebc

    • SHA512

      515d7b1aa7da3f06cad495c74ef0f930a698c0f189d305ccef7ef9e3dce9e25d40fb757349d85837523b7c0a3dc7def5ccd826b8b8c26037a28e98c761b0441b

    • SSDEEP

      24576:XxytKBYLie79KaVrR9zfQ4WFYrwyIGyAuajUdVeQ0dtmDoJXxfnsEYwRhikcm9Xi:XRYLtUaVrbD3rwLJawe9ftnLveN6Km

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks