Extracted

• • Target
    random.exe
  • Size 4.4MB
  • SHA256 64f08caee40b30f2a692181d99a36d9458317a8bfb35bb12a95f60d4dc596f81
  • MD5 cb04d30c4a93888c65291d036499de89
  • SHA1 d687415ca74c0ca4f20945a860c87c143cc4bdbe
  • SHA512 d9866dfe9cfead7ffc01af4b23647de36effdeb88500dcc42120b8721f947e2d36f79219f3f9a4bb42d4bf3adafeea97eb840767ceead62796630991ef26332d
  • SSDEEP 98304:x/PvttkE12ZP3fQ8ki7FmjW65khukAFWac8V07VZUTJb:tvIEEZA8k3WE4zA8az
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleanerdefense_evasiondiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1