Extracted

• • Target

    0b6967f41a54cb499a30e44e1161f549684097d543a10907ad250e76b4dfa66d.exe

  • Size

    4.0MB

  • MD5

    b1e139d753704b3e7e4bdea315ce310f

  • SHA1

    7fa05d77ae40ab9bb464bc6da4a5d1ba6438197f

  • SHA256

    0b6967f41a54cb499a30e44e1161f549684097d543a10907ad250e76b4dfa66d

  • SHA512

    5ee8b40f53b8b05549b9ef87bb9bc9a2bc55cb9391e10b9f5bcfcc1d0a53b934679be63295ff7b8b28e42f8350b8224c124798caa8dac287f3f4715fab382423

  • SSDEEP

    98304:4KlxGYCN6mG5FKk+znNWuwgmHwaUQ11c7vv2RgPOYi:HCYY6H3Kk+zNW4zHwc7eyi

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2