Extracted

• • Target

    SecuriteInfo.com.Win32.Evo-gen.746.19150.exe

  • Size

    4.1MB

  • MD5

    4ac24856279738f01cd90977899295c6

  • SHA1

    9552a6d3c7345bf34a992bd8417f2830739e8d98

  • SHA256

    9f768badd73c47a68ceabde639429d3b53b40270186eae8bce35b2f2aaa8628d

  • SHA512

    22aa7bad768b11226d7887f42d983e9332424fad61f6b26ae449fd1bebeaaa1c58ce9b0a966729c5a0e753c4ad5d8e2c9931695e04dd5d7819e96d29d4f5516e

  • SSDEEP

    49152:/XWDR7+k2KCKf54uchQA/l2PFRsqh9og9U2TqRzi4rt03tBzZb1IPGxpmOwjVQT:+ck2G54uqaFaqF9L+di4rt03Zqe/6V

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2