Overview

overview

10

Static

static

3

55e085ce8f...78.exe

windows7-x64

10

55e085ce8f...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55e085ce8fa8716438cc05109301b978.exe

  • Size

    4.4MB

  • Sample

    250326-sjk29axtbz

  • MD5

    55e085ce8fa8716438cc05109301b978

  • SHA1

    97497261f754261da811436ef8e61c6779b6ea3b

  • SHA256

    63c28edf52979a1cc3b621872db1bc1135d32545f2ec5a6a461a5187fcb0d53c

  • SHA512

    31728ad8782a1a7568d6ba2bf63400d2b1d0c11628e0d387c3ef56f9e22e289ca9360945b9fcc371c0734adf543c16e4bb3ea69ec15aec2734711f76ba0ea200

  • SSDEEP

    98304:CjDm5fWuicPDD4CmE1wYzf3T54eCNcpRPYfsESoRr8uurgJrSCVi0X:km5f1KExfD5MNuRgfhrorWrS4X

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      55e085ce8fa8716438cc05109301b978.exe

    • Size

      4.4MB

    • MD5

      55e085ce8fa8716438cc05109301b978

    • SHA1

      97497261f754261da811436ef8e61c6779b6ea3b

    • SHA256

      63c28edf52979a1cc3b621872db1bc1135d32545f2ec5a6a461a5187fcb0d53c

    • SHA512

      31728ad8782a1a7568d6ba2bf63400d2b1d0c11628e0d387c3ef56f9e22e289ca9360945b9fcc371c0734adf543c16e4bb3ea69ec15aec2734711f76ba0ea200

    • SSDEEP

      98304:CjDm5fWuicPDD4CmE1wYzf3T54eCNcpRPYfsESoRr8uurgJrSCVi0X:km5f1KExfD5MNuRgfhrorWrS4X

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks