Extracted

• • Target

    bd49155860e9d1bc26bf8eb98df7666a1a10fd614092c6c449cc9f54057233ae.exe

  • Size

    4.2MB

  • MD5

    0716c23867ff59f7d36eae6bb3a47678

  • SHA1

    4b15c19725ced8ccd5f627129d5430507fa4bc6f

  • SHA256

    bd49155860e9d1bc26bf8eb98df7666a1a10fd614092c6c449cc9f54057233ae

  • SHA512

    ca7c3dccbd497a9edcf2ac4bc3297456dcb3ec063defbdfe2700a910f933db3a0f74021c3d95964bab5186868a7eb11ec484aaf36f54008ad168416b9b821bf3

  • SSDEEP

    98304:6JNf2heI8D1ovmCLIhOuYZ5gpaLJrWwXW5R+kL1V:6JNfb8mUI61ZW5R+kr

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2