MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 19ae03c7f06efdcb94dab279f478f4256498c0a7501c327aa1cb13247f74f2b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GCleaner
Vendor detections: 13
| SHA256 hash: | 19ae03c7f06efdcb94dab279f478f4256498c0a7501c327aa1cb13247f74f2b4 |
|---|---|
| SHA3-384 hash: | 97f7574982527db8935afb309c07f7e542544bdf66543a74d4ef9d3d15f8892acc34a89412c917426ca6879a105ceb32 |
| SHA1 hash: | 32ba680c41cce1b585a7d1c9ac504a784e15cfaa |
| MD5 hash: | 6d285058a6d02424698eea4b9f85d069 |
| humanhash: | tennessee-table-november-bacon |
| File name: | file |
| Download: | download sample |
| Signature | GCleaner |
| File size: | 1'995'567 bytes |
| First seen: | 2023-03-26 13:00:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'463 x Socks5Systemz, 262 x RaccoonStealer) |
| ssdeep | 49152:EGlJfsZuP/EPpXL9NU8odlm4Y8ZrH1835pX03L5dlLYp:5JypheJsv8ZT1o5pk1PYp |
| Threatray | 57 similar samples on MalwareBazaar |
| TLSH | T1A595338BD3E4047FD163D5B18A59809DC9B333AF487C0595D2BCEA0E1F2E7886996393 |
| TrID | 50.3% (.EXE) Win32 Executable PowerBASIC/Win 9.x (148303/79/28) 37.2% (.EXE) Inno Setup installer (109740/4/30) 4.8% (.EXE) Win32 Executable Delphi generic (14182/79/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter |  andretavare5 |
| Tags: | exe gcleaner |
Intelligence
File Origin
# of uploads :
1
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-03-26 13:02:04 UTC
Tags:
installer gcleaner loader opendir cryptbot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Modifying a system file
Creating a file in the %AppData% subdirectories
Sending an HTTP GET request
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the Windows subdirectories
Launching a tool to kill processes
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware installer overlay packed packed shell32.dll
Verdict:
Malicious
Labled as:
HEUR/AGEN.1332570
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for dropped file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Privateloader
Status:
Suspicious
First seen:
2023-03-26 13:01:09 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
15 of 24 (62.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 47 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Score:
10/10
Tags:
family:gcleaner discovery loader
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
GCleaner
Malware Config
C2 Extraction:
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
45.12.253.72
45.12.253.98
45.12.253.75
Unpacked files
SH256 hash:
ff7fd5ccdf21f53b0da3f80dab45ecc5f8540cf60ce7139a870702f595f86b9e
MD5 hash:
9ca25d72e208f61ef297a3b3d8fd7f95
SHA1 hash:
61baaddc18637e4d0ecab40ebbdd843bded1f192
Detections:
Nymaim
win_nymaim_g0
win_gcleaner_auto
SH256 hash:
1902b2bcb610b3eb0392765c2cde605092de36556cb4997507b851af0ac6f428
MD5 hash:
6107b57dc537d2eed3a4eb5d08ecc8d4
SHA1 hash:
5a990d0e7c195ded7b9fdecb8828715fd8c20d6c
SH256 hash:
753083de10b230da03c6e2bc4865bbefb9a9c94d8946699d3a6d903048f0ba94
MD5 hash:
fc245721f161c38115ecec21ef18971b
SHA1 hash:
0d7652a91c74b7861948293dfd80f1d7831a73fb
SH256 hash:
19ae03c7f06efdcb94dab279f478f4256498c0a7501c327aa1cb13247f74f2b4
MD5 hash:
6d285058a6d02424698eea4b9f85d069
SHA1 hash:
32ba680c41cce1b585a7d1c9ac504a784e15cfaa
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| Rule name: | win_gcleaner_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.gcleaner. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Dropped by
PrivateLoader
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.