Extracted

• • Target

    SecuriteInfo.com.Win32.Evo-gen.23212.18409.exe

  • Size

    4.1MB

  • MD5

    897b4c2cc2212fe4234b1ff917d95540

  • SHA1

    709ad4fa9e13e15c8eae7295ba8e3a60de2c7d1d

  • SHA256

    870ee2be0e428f7a9d0199d0895acfd1a1ec759f08e7d34d5a87de92eef8f9eb

  • SHA512

    a37f3f1d078aba4de8e05ced49fe7208f9565413384b2363c893f8066ccf3680aa5ec769c39dd4c2b155e0fa03d8428bb8a455c30a3ba0442b234f7e1cdc1587

  • SSDEEP

    98304:0tVCajuAYYV1hDClYaSN1c5wSp+cAY4Ghrtp08XOtBQESh:0tVCUp1h+lYD1c53ocfp08XxE

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2