Extracted

• • Target

    066c240c3fec6aa5150db849c2bd94e6ef77c7c6d4c65a6934c1f4e9d22798ed.exe

  • Size

    2.0MB

  • MD5

    8c0099c6cf3355140684e0157c1658ba

  • SHA1

    fdb6e46395fc202da5f3cfb40b2db9be9185efc8

  • SHA256

    066c240c3fec6aa5150db849c2bd94e6ef77c7c6d4c65a6934c1f4e9d22798ed

  • SHA512

    a949c28f18c9a1d99c9e53da740edac4fbdb2ddda2cbff90a66835650f1a8951e34d23e1d7fd94eb0fd8a67752abd0c7622fcb1978b162f78067dea59ba8c235

  • SSDEEP

    49152:81aZfNXlZZnwcaShd3bsfCtq1D8QHFCA:8UZdZyShd3bntq1YQF

  Score

  10^/10

  gcleanerdiscoveryevasionloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2