Extracted

• • Target

    random.exe

  • Size

    5.8MB

  • MD5

    9db96a63cb9b313e1e9f4f1b9c2d6246

  • SHA1

    3345c2450c377445c5eb2e00f7053f93f0675e30

  • SHA256

    fe759deb61edb63ba9c1ce351b7dcee8a816b7b68d034eef1fcd4e1331dc7eb3

  • SHA512

    e34a3c3683acd512ec66e5fd05aaa7dd19784612066ea326d13acb0ded93507fe58b2e18e72bddaa4cf88bfcc30bd20e10e6fdbf61a11e0086ee7b109d7739ca

  • SSDEEP

    24576:WFQNTuL4WtzhmNDwf4vZmsBBq+w5RSX3rvPImPD/RHJxxlW3q67niYJXv:WUCL4icA4UD58XMAr+iY

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2