Extracted

• • Target

    SecuriteInfo.com.Win32.Evo-gen.4184.31311.exe

  • Size

    4.1MB

  • MD5

    e4631666a647d5a1ac567bb0076f3cac

  • SHA1

    fce93029fa84bcd201f90c5c4c620b6cf9becf72

  • SHA256

    68e68c7846ecb07a272ab44beb4033c13a00296c6de7e02c20a4bf7fb7e757d3

  • SHA512

    5635e98cd36c3231c06aac12c4b5bd9961e3cc91c8a1d67083ec4bdb8a4eb0d3ca3a1d11473f444c25f6207261bfa2278415af16198924bc7400718ad7fb02ac

  • SSDEEP

    98304:W4corGv9gX1zLFNCJav9VHy+E0z1SaIXgp6yMKW:13Gv9gXdLFjry+p1SaIXgpwK

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2