gcleaner | d2978cf015e612a06069d724fa93a8d398eb79c1d276fafd74aa7d0b4d88835d | Triage

Sharing

General

Target

d2978cf015e612a06069d724fa93a8d398eb79c1d276fafd74aa7d0b4d88835dN.exe
Size

4.0MB
Sample

250216-l7bedssnct
MD5

6830a67f26a493032170a92a85cecd40
SHA1

5e39c0ed03aa07922d74fe2bf36aed4d4c9b5d54
SHA256

d2978cf015e612a06069d724fa93a8d398eb79c1d276fafd74aa7d0b4d88835d
SHA512

4a02a6611ab6f4a5b5eb0ec0698fe2d3e8c54c4f119cf04499331fef5730d8a46a331add32710b156e8aaa36d2be74ba1a8ef47b3b7154e7b7a3dfac544d0d99
SSDEEP

49152:FvLURhh5foXXpiO/1xVW/oDEIfiCUqlgPcbDcP4E5PNUwIocWMn/ePFDN+6XaH:FvKCXXpi6DhHUCgqDIFPCw15MmPFDov

Score

10^/10

gcleaner defense_evasion discovery loader

Malware Config

Targets

- Target
  
  d2978cf015e612a06069d724fa93a8d398eb79c1d276fafd74aa7d0b4d88835dN.exe
- Size
  
  4.0MB
- MD5
  
  6830a67f26a493032170a92a85cecd40
- SHA1
  
  5e39c0ed03aa07922d74fe2bf36aed4d4c9b5d54
- SHA256
  
  d2978cf015e612a06069d724fa93a8d398eb79c1d276fafd74aa7d0b4d88835d
- SHA512
  
  4a02a6611ab6f4a5b5eb0ec0698fe2d3e8c54c4f119cf04499331fef5730d8a46a331add32710b156e8aaa36d2be74ba1a8ef47b3b7154e7b7a3dfac544d0d99
- SSDEEP
  
  49152:FvLURhh5foXXpiO/1xVW/oDEIfiCUqlgPcbDcP4E5PNUwIocWMn/ePFDN+6XaH:FvKCXXpi6DhHUCgqDIFPCw15MmPFDov
Score

10^/10

gcleaner defense_evasion discovery loader
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gcleaner family
  gcleaner
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gcleanerdefense_evasiondiscoveryloader

behavioral2

gcleanerdefense_evasiondiscoveryloader