Overview

overview

10

Static

static

3

f3be56ce2e...29.exe

windows7-x64

10

f3be56ce2e...29.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3be56ce2e51c5c49e0cb9f91386f4c268cd2f9f39b470ece9f11d1f3324c229.exe

  • Size

    4.5MB

  • Sample

    250327-w38jfaykx3

  • MD5

    534293cb73c3508efe5870640fbb3acb

  • SHA1

    9fc4e7cc1defb8def193e594764a0cd2f8207e6b

  • SHA256

    f3be56ce2e51c5c49e0cb9f91386f4c268cd2f9f39b470ece9f11d1f3324c229

  • SHA512

    9024dc192e0eae5f5d021a9afb53de41732f16d8af6311b7513ad9bfec1d27fa2e1e82404718e5abe58cdf175ce2323bf3dd061c8d7144d99df8708abb10444a

  • SSDEEP

    98304:xBeJ/wXvd9CJ9TT2A+8t2N1t5civAoINhHeJe8tpRKylny6:xBZ19Gu8t6wkCBeltrKgy6

Score
10/10
gcleanerdefense_evasiondiscoveryloader

Malware Config

Targets

    • Target

      f3be56ce2e51c5c49e0cb9f91386f4c268cd2f9f39b470ece9f11d1f3324c229.exe

    • Size

      4.5MB

    • MD5

      534293cb73c3508efe5870640fbb3acb

    • SHA1

      9fc4e7cc1defb8def193e594764a0cd2f8207e6b

    • SHA256

      f3be56ce2e51c5c49e0cb9f91386f4c268cd2f9f39b470ece9f11d1f3324c229

    • SHA512

      9024dc192e0eae5f5d021a9afb53de41732f16d8af6311b7513ad9bfec1d27fa2e1e82404718e5abe58cdf175ce2323bf3dd061c8d7144d99df8708abb10444a

    • SSDEEP

      98304:xBeJ/wXvd9CJ9TT2A+8t2N1t5civAoINhHeJe8tpRKylny6:xBZ19Gu8t6wkCBeltrKgy6

    Score
    10/10
    gcleanerdefense_evasiondiscoveryloader

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Gcleaner family

      gcleaner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks