Detects LgoogLoader payload

GCleaner

GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

LgoogLoader

A downloader capable of dropping and executing other malware families.

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Checks for common network interception software

Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

Downloads MZ/PE file

Drops file in Drivers directory

Executes dropped EXE

Sets service image path in registry

VMProtect packed file

Detects executables packed with VMProtect commercial packer.