Overview

overview

10

Static

static

3

2bf4c29ed6...62.exe

windows7-x64

10

2bf4c29ed6...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2bf4c29ed6ed320648489a948ccdd6cdd186fee526a43894ba6b9126ccdffc62

  • Size

    1.9MB

  • Sample

    250205-z15xbaslav

  • MD5

    7442b0ad5a44f533f26b72223fb46c4c

  • SHA1

    79b474d0f9a128e5ab191abb3196a54e18588634

  • SHA256

    2bf4c29ed6ed320648489a948ccdd6cdd186fee526a43894ba6b9126ccdffc62

  • SHA512

    ade2ff9b93b92b0b0521f05ccf97d577145951801aef2b397ab0bdaefc3185a3e8ce462b8be8c6dbbad569292fd8dae918aa2a79f5731188e62c3661f841e8b4

  • SSDEEP

    49152:VMGESCHp8uiC6bzLIQdC68jdKd/3ETP0C6s8Yps:VVRopFV6jIXzjs9oasW

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      2bf4c29ed6ed320648489a948ccdd6cdd186fee526a43894ba6b9126ccdffc62

    • Size

      1.9MB

    • MD5

      7442b0ad5a44f533f26b72223fb46c4c

    • SHA1

      79b474d0f9a128e5ab191abb3196a54e18588634

    • SHA256

      2bf4c29ed6ed320648489a948ccdd6cdd186fee526a43894ba6b9126ccdffc62

    • SHA512

      ade2ff9b93b92b0b0521f05ccf97d577145951801aef2b397ab0bdaefc3185a3e8ce462b8be8c6dbbad569292fd8dae918aa2a79f5731188e62c3661f841e8b4

    • SSDEEP

      49152:VMGESCHp8uiC6bzLIQdC68jdKd/3ETP0C6s8Yps:VVRopFV6jIXzjs9oasW

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks