Extracted

Extracted

Extracted

• • Target
    file.exe
  • Size 1.9MB
  • SHA256 c9abeb237b284d2aee39f0c69a1042aa3dbe285aa528f23ffdaed82a0a08a229
  • MD5 0e7d49c38e45d1c993985279e08ed159
  • SHA1 405dc75e2d9ab33723b4ddf107a98b16d3ae3cb0
  • SHA512 11b03a48a047e2a0219f937964287a815fc49e9c685b2ccfbeb9bc2b565138f33fdebd036ad1525f025ef16adef1f08d4d8eec0465f3d9e532ff4f6512df604a
  • SSDEEP 49152:mo51SyUlCE4JQFBpqahlYrsoITZCAx1GTj:H1S1QEvBprhOY/CAx1GTj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleanerdiscoveryloaderraccoonvidar597db93e0d0875ba0f35b0afd8258337565evasionspywarestealerthemidatrojan

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2