Gt32Supportgeeks

Overview

Rogue:Win32/GT32SupportGeeks is a highly specific family of Scareware intimately tied to Tech Support Scams. It operates by locking the user's browser or displaying highly alarming, fake system errors, providing a toll-free number the user must call to 'resolve' the fake infection, leading directly to social engineering and financial extortion.

Understanding GT32SupportGeeks
To the victim, a GT32SupportGeeks infection is terrifying. A loud audio siren may play, and a full-screen window mimicking a Microsoft or Apple security alert appears, claiming the computer is blocked due to illegal activity or a severe virus. For a security analyst, this is a hybrid attack. The malware itself is relatively simple; its sole purpose is to facilitate the social engineering phase (`T1566`), where the victim calls a fraudulent call center and is coerced into paying hundreds of dollars for fake 'support' services.

Execution and the Scam Mechanism
GT32SupportGeeks is distributed via malvertising (malicious ads on legitimate sites) (`T1189`). When the ad executes, it uses JavaScript loops (`T1059.007`) in the browser to prevent the user from closing the tab or navigating away (Browser Locking). If dropped as an executable, it modifies the Registry (`T1112`) to launch full-screen on boot, disabling Task Manager and hiding the taskbar. When the victim calls the provided number, the scammers often request Remote Desktop access (via legitimate tools like TeamViewer or AnyDesk) (`T1219`). Once granted access, the scammers steal data, install actual malware, or simply run empty commands in a terminal to pretend they are 'fixing' the computer.

Indicators of Compromise & Impact
The impact is extreme financial fraud and the compromise of the endpoint if the user granted remote access. Network logs will show traffic to domains known for hosting tech support scam infrastructure. EDR platforms will flag the unauthorized installation of remote access tools (RATs) if the victim permitted the scammer to connect.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.007: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1566: Implement email filtering, Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and DMARC. Conduct user phishing awareness training.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_GT32SUPPORTGEEKS {
    meta:
        description = "Detects Gt32Supportgeeks (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "gt32supportgeeks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Gt32Supportgeeks Activity
id: 65a649e0afc29233a55aac8c317da6ed
status: experimental
description: Detects generic indicators of the gt32supportgeeks malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*gt32supportgeeks*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. If the alert is contained within a web browser, use Task Manager (`Ctrl+Shift+Esc`) to forcefully terminate the browser process; do not attempt to click 'close' on the fake alert.
2. If the user actually called the number and granted remote access, instantly disconnect the machine from the network.
3. Assume total endpoint compromise if remote access was granted; perform a clean OS rebuild and enforce password resets for all accounts.
4. Advise the user to immediately contact their bank and dispute any charges made to the fraudulent 'tech support' company.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Never call the toll-free number displayed on the screen; Microsoft, Apple, and legitimate AV vendors do not display phone numbers in security alerts.
2. Avoid trying to interact with the fake lock screen, as it may trigger the downloading of secondary malware payloads.

References & External Analysis

• Search "gt32supportgeeks" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Widdit
• Warezov
• Lightlogger
• Ytddownloader
• Jawego

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/gt32supportgeeks.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.