Extracted

• • Target

    random.exe

  • Size

    4.3MB

  • MD5

    01e491772d07506cd5a5cf2e9932911d

  • SHA1

    4cb8a0da13639b92911e2dee1b800db1179fa6f2

  • SHA256

    873c186d0819be9542ecba64b0889862549a4bf7e455430169fc9cc92e78774b

  • SHA512

    dbe65e73fbc78febe55bc8be5ec960baf6c78f5e4bcf98bb8b8b32c05299ddbb9ce3f88c002df0b85eb58cfd0368ca0c0d6cf145f80554bac70181bf0ec64339

  • SSDEEP

    98304:BmpxshQkpjtsVUT1PuSkZm+2XC0hkQ6o8VaJkDjaAP:BcxwQkpjqkPutqS0hkgeDjz

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1