Extracted

• • Target

    file.exe

  • Size

    1.9MB

  • MD5

    eace7f36dc34577a63cffa508f7aff29

  • SHA1

    d572c98b34aabe8fd27344c37fd0c8ca039d02a5

  • SHA256

    970b1fe105bbe418f79ecae867d42d511bc6c9a8b4b9eb53095ff33149da02a3

  • SHA512

    761c263dae4d56d8799969c7adecf327e3ac0120ec9dca32eb6c8b7b84a0baaf080912da941158c317ff9bb5f291633f9b0655ff2d66f56bf1ab4359a34885c8

  • SSDEEP

    49152:i/ifSypauOU8y7x4XRJYStklRz9gxKxguc7bkkN:MMXHn7x4zYSalp/

  Score

  10^/10

  gcleanerdiscoveryevasionloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2