MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693
SHA3-384 hash: 27878692a47148b3d10ee8deb0bea052ce9f5189f02d8e95e23ded239eee5ad1fb80e8fa5998e6b4f743031d1d4093b4
SHA1 hash: b0e2d8465543797c16cef56ed28f3b1beb931071
MD5 hash: 0f5ef22356b0cb177b794b70c5f41bac
humanhash: yellow-pip-september-quiet
File name:LisectAVT_2403002C_30.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:471'049 bytes
First seen:2024-07-25 01:47:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4904df65844c64eb772fc58b1bf956e (1 x Stealc, 1 x Rhadamanthys, 1 x Worm.Ramnit)
ssdeep 6144:zyqIeagHOk1K6NQxuboosFFFXj4mEX4Adc2Ugu502O04UNeh:GqI1w1K6l0fFVGbqBgu1O0d0
Threatray 64 similar samples on MalwareBazaar
TLSH T1B7A4CF42B2E1EC60ED6E4B3E8D39C6E4663EFD214E196A5732587F0F1471092E62372D
TrID 67.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.2% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0000105008020400 (1 x GCleaner)
Reporter Anonymous
Tags:exe gcleaner


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint microsoft_visual_cc overlay packed stealc
Link:
https://www.filescan.io/uploads/66a1aed74c5c17942a7d3f54/reports/094de407-8512-45b8-86ff-c4cc993f26c4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1481361
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693/
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2024-07-25 01:48:06 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdjkqi7m72xarzlekkoits4qgjyoh43fqv6nb3jof6tbpnzfa2jq._file
Verdict:
malicious
Similar samples:
0918a0e9939f235924a5fb65284c97efff83f871bc1851c7e61b1b9800512885
GCleaner
10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693
GCleaner
2a27f01ed2a25d9f6145902608570413d90133aa5e8d9cb7777026447977c9f0
GCleaner
31c6a028ab500d3b8c6d53c5827ffdd773146a55306f3196271dce2f548aa020
GCleaner
47e56f3493eeb0f41a19e825ab34bc25176aef6708f1e20df70f9dbe0c4f1203
GCleaner
adffd52446d0d94c4f726205482a0c062248d6eb35948df937336957cf747db8
GCleaner
cac7fc4ae9c97eba7455992b2d41449ee257ec485c562bfc7245a90033b1d774
GCleaner
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240725-b7plxa1cnn/
Behaviour
Program crash
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0a57c7d7-a419-4f64-807b-cfba3ca4b872
Unpacked files
SH256 hash:
931309bc4cca2b42beae4a162c200bf76dc5a3dba9980f93d7959dc1001b9ce8
MD5 hash:
99d28717b9cb591d0b548fc2873df89e
SHA1 hash:
05ecc1925c885303e69b05083f2257b28e168c5a
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/04d71283-a5cb-4b52-a9c0-9e92305948d1/
Parent samples :
eb23bd38359eab51092a1322cd491a109532bb42d90a6345ab720e5b95d6c5d8
0918a0e9939f235924a5fb65284c97efff83f871bc1851c7e61b1b9800512885
31c6a028ab500d3b8c6d53c5827ffdd773146a55306f3196271dce2f548aa020
10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693
30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea
SH256 hash:
10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693
MD5 hash:
0f5ef22356b0cb177b794b70c5f41bac
SHA1 hash:
b0e2d8465543797c16cef56ed28f3b1beb931071
Link:
https://www.unpac.me/results/04d71283-a5cb-4b52-a9c0-9e92305948d1/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GCleaner

Executable exe 10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationUSER32.dll::GetUserObjectSecurity
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindFirstVolumeMountPointW
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetVolumeInformationA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::PeekConsoleInputA
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::ReadConsoleOutputCharacterA
KERNEL32.dll::SetConsoleTextAttribute
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::GetWindowsDirectoryA
KERNEL32.dll::RemoveDirectoryA
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::QueryDosDeviceW

Comments