Gt32Supportgeeks

Overview

GT32SupportGeeks (tracked in telemetry under signatures PUA:Win32/GT32SupportGeeks, Rogue:Win32/GT32SupportGeeks, and Program:Win32/GT32SupportGeeks) is a deceptive technical support scareware application and screen locker. Distributed via misleading pop-under advertisements, browser redirection loops, and bundled software installers, GT32SupportGeeks locks the user interface with an alarming full-screen error screen masquerading as a Windows fatal system crash (BSOD) or critical security lockdown. The interface displays toll-free telephone numbers coercing victims into calling fake technical support call centers, where fraudulent operators charge hundreds of dollars for fake remediation services and install secondary remote access tools. GT32SupportGeeks writes startup keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, disables access to Task Manager, and suppresses keyboard shortcuts (such as Alt+Tab and Windows key) to prevent the user from exiting the scareware interface.

Known aliases

Threat reports may refer to this family under multiple names:

• PUA:Win32/GT32SupportGeeks
• Rogue:Win32/GT32SupportGeeks
• Program:Win32/GT32SupportGeeks
• Win32/GT32SupportGeeks
• Scareware.GT32SupportGeeks

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_GT32SUPPORTGEEKS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gt32Supportgeeks"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "gt32supportgeeks" ascii wide nocase
        $s2 = "pua:win32/gt32supportgeeks" ascii wide nocase
        $s3 = "rogue:win32/gt32supportgeeks" ascii wide nocase
        $s4 = "program:win32/gt32supportgeeks" ascii wide nocase
        $s5 = "win32/gt32supportgeeks" ascii wide nocase
        $s6 = "scareware.gt32supportgeeks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Gt32supportgeeks (Pua) Execution & Triage
id: 29af7d79-3b0d-5ba2-a919-babce349e614
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Gt32supportgeeks malware family. Detects suspicious execution from temporary
  user directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/gt32supportgeeks
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.pua
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1189
- attack.t1491_001
- attack.t1547_001
- attack.t1562_001
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_GT32SUPPORTGEEKS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gt32Supportgeeks tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "gt32supportgeeks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Advise the end user not to call the displayed phone numbers or grant remote desktop access.
2. Reboot the machine into Safe Mode with Networking to bypass the fullscreen lock hook.
3. Terminate active scareware processes via Task Manager or elevated PowerShell commands.
4. Remove startup registry entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
5. Run a full antimalware scan to eliminate leftover scareware modules and reset browser preferences.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not call the displayed telephone numbers or provide payment card numbers.
2. Do not install remote assistance utilities requested by unauthorized phone operators.

References & External Analysis

• Microsoft Defender Threat Encyclopedia - PUA:Win32/GT32SupportGeeks
• Malwarebytes Labs - Tech Support Scams Overview
• Sophos Threat Center - GT32SupportGeeks Analysis
• Search "gt32supportgeeks" on VirusTotal (External Analysis)
• Search "gt32supportgeeks" on Any.Run (Sandbox Sandbox)
• Search "gt32supportgeeks" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Pua)

Explore other documented threats in the same operational category:

• Installcore
• Cloudguard
• Pccleaner
• Tweakbitdu
• Vittalia
• Appset
• Dnscleaner
• Playtech

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/gt32supportgeeks.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.