Overview

overview

10

Static

static

3

92911c2e82...3c.exe

windows7-x64

10

92911c2e82...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92911c2e829dc125ea4fc59f8c1be51dd46a6c753a0fc43b40af69d847e6393c

  • Size

    1.8MB

  • Sample

    250126-zat25atngj

  • MD5

    593ac8b009c78ed4878623b78a8cd4a9

  • SHA1

    0c4d1bf06fa729e0e1579f1ebdaeadf3b0a2a71e

  • SHA256

    92911c2e829dc125ea4fc59f8c1be51dd46a6c753a0fc43b40af69d847e6393c

  • SHA512

    4c33e3025321ec40fee05ade7cecf377e05102b022086d2be6fe66ed8050b835ec4a5dacdf6fa3c3a566f5b39c5d07ca5014f395bf885c95e67ddd942c5f0a15

  • SSDEEP

    49152:3VpkJiTW1+lXeTA0lBJIJoVtF7EsvrC4p64X6vyZ3VMyAr:3VpkJiTG00KJoLZjCm6BF

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      92911c2e829dc125ea4fc59f8c1be51dd46a6c753a0fc43b40af69d847e6393c

    • Size

      1.8MB

    • MD5

      593ac8b009c78ed4878623b78a8cd4a9

    • SHA1

      0c4d1bf06fa729e0e1579f1ebdaeadf3b0a2a71e

    • SHA256

      92911c2e829dc125ea4fc59f8c1be51dd46a6c753a0fc43b40af69d847e6393c

    • SHA512

      4c33e3025321ec40fee05ade7cecf377e05102b022086d2be6fe66ed8050b835ec4a5dacdf6fa3c3a566f5b39c5d07ca5014f395bf885c95e67ddd942c5f0a15

    • SSDEEP

      49152:3VpkJiTW1+lXeTA0lBJIJoVtF7EsvrC4p64X6vyZ3VMyAr:3VpkJiTG00KJoLZjCm6BF

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks