MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea
SHA3-384 hash: 79760b0d1594a5e3c8a3b6be83a43c1bd641102f49b5d78ea3c1a2a594facf055268e8b2a3eccd7ff0d083162e0a708f
SHA1 hash: 2b3b7fba9591cae769746c13bc912f2a1d5b7923
MD5 hash: a5fb2a7aac8489f1f1736b6111c629a9
humanhash: spaghetti-december-july-nine
File name:LisectAVT_2403002C_40.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:423'433 bytes
First seen:2024-07-25 01:47:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ff23e32a63aac9251bb507fbef91be04 (2 x Stealc, 2 x Amadey, 2 x Smoke Loader)
ssdeep 6144:qPnBIv7KK61briFIBP/4ihteJN+Bq+Pmkee/n7DKD:GO7KK6xWFI9/4iYIBtrH/7uD
Threatray 18 similar samples on MalwareBazaar
TLSH T12394E00276E1ECB0E1A75A3159749A950A3FFC728D71895733882B0F6CB11C1AE77B93
TrID 46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.5% (.EXE) Win64 Executable (generic) (10523/12/4)
5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 0204040b28183000 (1 x Stealc, 1 x GCleaner)
Reporter Anonymous
Tags:exe gcleaner


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint microsoft_visual_cc overlay packed stealc
Link:
https://www.filescan.io/uploads/66a1aee44c5c17942a7d3f59/reports/682817e5-8a15-4ccd-a6b8-6abf11435dcd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1481347
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea/
Threat name:
Win32.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2024-07-25 01:48:18 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gctellns3glfhwbbz7fsikgkboz7q7wjz2gbfqi62g6v2t2gk7va._file
Verdict:
malicious
Similar samples:
0918a0e9939f235924a5fb65284c97efff83f871bc1851c7e61b1b9800512885
GCleaner
2a27f01ed2a25d9f6145902608570413d90133aa5e8d9cb7777026447977c9f0
GCleaner
31c6a028ab500d3b8c6d53c5827ffdd773146a55306f3196271dce2f548aa020
GCleaner
47e56f3493eeb0f41a19e825ab34bc25176aef6708f1e20df70f9dbe0c4f1203
GCleaner
adffd52446d0d94c4f726205482a0c062248d6eb35948df937336957cf747db8
GCleaner
cac7fc4ae9c97eba7455992b2d41449ee257ec485c562bfc7245a90033b1d774
GCleaner
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240725-b781js1crp/
Behaviour
Program crash
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/538d2d46-f16e-4b25-bd70-caafffa4d4fa
Unpacked files
SH256 hash:
931309bc4cca2b42beae4a162c200bf76dc5a3dba9980f93d7959dc1001b9ce8
MD5 hash:
99d28717b9cb591d0b548fc2873df89e
SHA1 hash:
05ecc1925c885303e69b05083f2257b28e168c5a
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/54b8ec1d-6375-4133-b2f3-297662616e86/
Parent samples :
eb23bd38359eab51092a1322cd491a109532bb42d90a6345ab720e5b95d6c5d8
0918a0e9939f235924a5fb65284c97efff83f871bc1851c7e61b1b9800512885
31c6a028ab500d3b8c6d53c5827ffdd773146a55306f3196271dce2f548aa020
10d2a823ecfeae08e564529c89cb903270e3f365857cd0ed2e2fa617b7250693
30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea
SH256 hash:
30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea
MD5 hash:
a5fb2a7aac8489f1f1736b6111c629a9
SHA1 hash:
2b3b7fba9591cae769746c13bc912f2a1d5b7923
Link:
https://www.unpac.me/results/54b8ec1d-6375-4133-b2f3-297662616e86/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:EXE_Stealer_StealC_Feb2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GCleaner

Executable exe 30a645adb2d99653d821cfcb2428ca0bb3f87ec9ce8c12c11ed1bd5d4f4657ea

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindFirstVolumeMountPointA
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetVolumeInformationA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::PeekConsoleInputA
KERNEL32.dll::ReadConsoleA
KERNEL32.dll::SetConsoleTextAttribute
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleAliasExesLengthA
KERNEL32.dll::GetConsoleAliasW
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::GetWindowsDirectoryA
KERNEL32.dll::RemoveDirectoryA
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::QueryDosDeviceA

Comments