Overview

overview

10

Static

static

3

48e56aa0eb...e2.exe

windows7-x64

10

48e56aa0eb...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48e56aa0eb3e20765f9626e560974f4845d142c0c7ebaaf9e00aa4a251f41ee2

  • Size

    1.8MB

  • Sample

    250126-v53wasypfk

  • MD5

    5dba80b5b0f1ef6010548f776971d72b

  • SHA1

    03e7bc70278a83c354e38f81f6672fcabbd37d18

  • SHA256

    48e56aa0eb3e20765f9626e560974f4845d142c0c7ebaaf9e00aa4a251f41ee2

  • SHA512

    47c60ddc6883e5a46df47412c615403ed30970d6c83c81c543a8889ee7c98e40d193cc545ec8e48d759997d4a25f8a41a0a193e2f7b7ee2a42c4ffe47ce4db09

  • SSDEEP

    24576:z0p0l313eV05hbQP2u0iXkQylAgna7+C5ZHAzGAayRCs8NKkju3gU1IcbaWPowPV:pL3005hbQPlHgn++szUEsuKx3gAt/6

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      48e56aa0eb3e20765f9626e560974f4845d142c0c7ebaaf9e00aa4a251f41ee2

    • Size

      1.8MB

    • MD5

      5dba80b5b0f1ef6010548f776971d72b

    • SHA1

      03e7bc70278a83c354e38f81f6672fcabbd37d18

    • SHA256

      48e56aa0eb3e20765f9626e560974f4845d142c0c7ebaaf9e00aa4a251f41ee2

    • SHA512

      47c60ddc6883e5a46df47412c615403ed30970d6c83c81c543a8889ee7c98e40d193cc545ec8e48d759997d4a25f8a41a0a193e2f7b7ee2a42c4ffe47ce4db09

    • SSDEEP

      24576:z0p0l313eV05hbQP2u0iXkQylAgna7+C5ZHAzGAayRCs8NKkju3gU1IcbaWPowPV:pL3005hbQPlHgn++szUEsuKx3gAt/6

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks