Extracted

• • Target

    random.exe

  • Size

    4.1MB

  • MD5

    04a9a323fde7caa8947bc8c052e08bca

  • SHA1

    b8a4ef1d8c7f63d4aa0db0c6b4672c6da8e046cd

  • SHA256

    ffab54a5b0b77ee2d3ebe3d0bd42f5ee52af594691a8b465b426ca91107c380d

  • SHA512

    90e2aed93cfb352a8f6e41d73c9a07d5a7920b5201fb46ba241aba3ba6fbd3cb071c1fa68f8d25b569c933b27eda68e8ac6a3dc44a9015c6eb0030609173c068

  • SSDEEP

    98304:pXamK1ZgavZ0fAtgQ417ForkcT/9/r3exW8EHZaIdHHDYVLe:51KvzvqA6HhoQcb9/LV8gZXdHM

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2