Overview

overview

10

Static

static

3

f986f638ec...f0.exe

windows7-x64

10

f986f638ec...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f986f638eca51ed052b39c0248f0ebaaf1aa7f3bab8a5b51171f81656ef095f0

  • Size

    1.8MB

  • Sample

    250126-rdg8qsvkbr

  • MD5

    96ddd6fd12c2a247b8fc97cff870b91d

  • SHA1

    e00cd842520710048abb878f0cfb02dda28960e2

  • SHA256

    f986f638eca51ed052b39c0248f0ebaaf1aa7f3bab8a5b51171f81656ef095f0

  • SHA512

    a54408b339f2597859b04dd020309ab83d06aff07c0316e48e928230d308af9423bda052ebcf0e19a16a8d20bd478379a622c9e9cc2e6193bfde0e402e6ffc30

  • SSDEEP

    49152:XzcjMaMKs3yYCQ7lXfhEhXvtvV3BrePrPn7Z7:XgjMaMNCYNIBUrP7

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      f986f638eca51ed052b39c0248f0ebaaf1aa7f3bab8a5b51171f81656ef095f0

    • Size

      1.8MB

    • MD5

      96ddd6fd12c2a247b8fc97cff870b91d

    • SHA1

      e00cd842520710048abb878f0cfb02dda28960e2

    • SHA256

      f986f638eca51ed052b39c0248f0ebaaf1aa7f3bab8a5b51171f81656ef095f0

    • SHA512

      a54408b339f2597859b04dd020309ab83d06aff07c0316e48e928230d308af9423bda052ebcf0e19a16a8d20bd478379a622c9e9cc2e6193bfde0e402e6ffc30

    • SSDEEP

      49152:XzcjMaMKs3yYCQ7lXfhEhXvtvV3BrePrPn7Z7:XgjMaMNCYNIBUrP7

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks