Extracted

• • Target
    3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe
  • Size 1.2MB
  • SHA256 3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2
  • MD5 7a77d61135bd13e07009198cb6e5974a
  • SHA1 57c5682efff6d39ece4c4f822ae8af0c23a0590b
  • SHA512 41059a083a3d11453b6ad4a046f24fabf73fffa53fd4db201e81d77a0445976e3df14dc890d040527cbda8ab86d63ccca510dd60d5a41b189a2f347a579d8770
  • SSDEEP 24576:qMaUsoLTepLynuRbIiammvXHkwwxP9JOUOBhdD46nh/FaD0J9h:qRUsUP2Smmv3XPBhuqh9k+
  • TLSH
    T1EC457D32B291C43BD5B3163CDD2AA29994267D101D3D884F7EE85F4C1F39A813F6A297
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverygcleanerloaderprivilege_escalationexecutionpersistencespywarestealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2