Extracted

• • Target

    d4219157d8de6bb639892620034961242decf0a4e0507747328b799357ae146c.exe

  • Size

    1.9MB

  • MD5

    93999ecf3642ba33ba0b39bffc08e4ba

  • SHA1

    f3e08f4342106e75d42e4652690a00171f0799b6

  • SHA256

    d4219157d8de6bb639892620034961242decf0a4e0507747328b799357ae146c

  • SHA512

    ad61979a4e1517e2951b1443a97339cecfbae1a3e2b853aed50a3ad19d3c41be434bce83eeac22e887907b5e0d1302d5e8c434703105ff7225b99b3c319e98fe

  • SSDEEP

    49152:VuFa3j9c1mmTyirz+2V/64S5im8o3nXXCxHxY0ubJVr:Vea3j61mmTyirn64KiLoHX10M

  Score

  10^/10

  gcleanerdiscoveryevasionloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2