Extracted

• • Target

    SecuriteInfo.com.Win32.Evo-gen.9457.5283.exe

  • Size

    4.1MB

  • MD5

    96d90a009617baea91f4e6371297c641

  • SHA1

    6618d89f5aea2aae5fa57413183b961dcddc5acc

  • SHA256

    80bf989e1d118c7509a2f88030d012fba5b206b2f99248e2fad195862b646f18

  • SHA512

    9034bad861a750631fe92959b72abd1a99d0890b4424e7ae9467b48ce3133c2fd3b3502bed2dd04b7606b74fbaeacdaf9c2382e934aaf9b96957a7ffbb751227

  • SSDEEP

    98304:TVBS1RJUe+J1mhKv8x3JPnvv07FiAUwnjlIh7Ba7Lw6dkM8xEP:zS1RB+sKv8x3RHIFT/Ea7Mgx8i

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2