Extracted

• • Target

    a9e92705e50c5ee6795eb54011a4e1f68bdc6f15dd5effc25abf3cf7ea5c35fe.exe

  • Size

    1.9MB

  • MD5

    7f5a4d072a8a04f671be634f958fd98f

  • SHA1

    ff8de037e06004e1728e6d699f1be00b9139d795

  • SHA256

    a9e92705e50c5ee6795eb54011a4e1f68bdc6f15dd5effc25abf3cf7ea5c35fe

  • SHA512

    23ce79a762f80cfb3f1711dc9f2c22561cfcff65ed13bbf08919780eb86858e59aa8889f6409743501536eda07bd12cfb080120563f57a45e873e1add0f73eb6

  • SSDEEP

    49152:R/mUbQS/X309B3bMXM8du2L35lwYF0f4XM1eT9:RfkS/H8S42Ufp

  Score

  10^/10

  gcleanerdiscoveryevasionloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2