Overview

overview

10

Static

static

3

6744696192...8c.exe

windows7-x64

10

6744696192...8c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    674469619208e5e3104487b74fab44343f5d30bb32909c0b99ecfc97a8983e8c.exe

  • Size

    1.8MB

  • Sample

    250202-e1yssaxjep

  • MD5

    a7cd66db21008d3d30a5978d8d201c6e

  • SHA1

    f7886833a7f00fb3f05338ead61b538ecdf9fe29

  • SHA256

    674469619208e5e3104487b74fab44343f5d30bb32909c0b99ecfc97a8983e8c

  • SHA512

    6e0d67d28e3cd5c099805e191a4c7864c484f0b9e257c16322c2bfb3cce04da9a9aaf260e50f5b8c58e6e2b0cfcf884afc3fd163dc6de0545f380b9b356fd196

  • SSDEEP

    49152:XaiyOFKzsduIXxM2Jvn9XLMuJXVuylFhwK8+i:sYDXWAn9F6yiK8r

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      674469619208e5e3104487b74fab44343f5d30bb32909c0b99ecfc97a8983e8c.exe

    • Size

      1.8MB

    • MD5

      a7cd66db21008d3d30a5978d8d201c6e

    • SHA1

      f7886833a7f00fb3f05338ead61b538ecdf9fe29

    • SHA256

      674469619208e5e3104487b74fab44343f5d30bb32909c0b99ecfc97a8983e8c

    • SHA512

      6e0d67d28e3cd5c099805e191a4c7864c484f0b9e257c16322c2bfb3cce04da9a9aaf260e50f5b8c58e6e2b0cfcf884afc3fd163dc6de0545f380b9b356fd196

    • SSDEEP

      49152:XaiyOFKzsduIXxM2Jvn9XLMuJXVuylFhwK8+i:sYDXWAn9F6yiK8r

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks