Overview

overview

10

Static

static

3

97dfaa5e5d...2a.exe

windows7-x64

10

97dfaa5e5d...2a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97dfaa5e5d007d94b360c63dce4ded8648b3499a2d67e4af0baeb03c2d73052a

  • Size

    1.9MB

  • Sample

    250127-ae58hszqhz

  • MD5

    e4bad3fc22ea4f1db04fb13d6d29e183

  • SHA1

    ab8dc7caf885431c4c2c1c3c1eecd2f68fe0c5bb

  • SHA256

    97dfaa5e5d007d94b360c63dce4ded8648b3499a2d67e4af0baeb03c2d73052a

  • SHA512

    58cd93628206381c7f050ec5cf3f41b27e8ec87ae300bd116aee4bf32e2035e73f9341faf0bac194e707ec00059dd4c85d04ae294c45d543ce15825f266f36ae

  • SSDEEP

    49152:ZHKAz75k+rKNiSp7KflGw5HKLfagbB8mfgfUZUzqWD:h7yoK8SpsJADagbG0h

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      97dfaa5e5d007d94b360c63dce4ded8648b3499a2d67e4af0baeb03c2d73052a

    • Size

      1.9MB

    • MD5

      e4bad3fc22ea4f1db04fb13d6d29e183

    • SHA1

      ab8dc7caf885431c4c2c1c3c1eecd2f68fe0c5bb

    • SHA256

      97dfaa5e5d007d94b360c63dce4ded8648b3499a2d67e4af0baeb03c2d73052a

    • SHA512

      58cd93628206381c7f050ec5cf3f41b27e8ec87ae300bd116aee4bf32e2035e73f9341faf0bac194e707ec00059dd4c85d04ae294c45d543ce15825f266f36ae

    • SSDEEP

      49152:ZHKAz75k+rKNiSp7KflGw5HKLfagbB8mfgfUZUzqWD:h7yoK8SpsJADagbG0h

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks