MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 17


Intelligence 17 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
SHA3-384 hash: 2497f09b06d65d366fb9cfc67f14adc14bbac00e8e4be6f0ccc562d9f1f0c6cff61445c45f2f13bba6f3c38faf4d8b17
SHA1 hash: f5858ef634c482e050968217da72d0d94f9ec357
MD5 hash: f81a62e066a6ffdbcfdae281aef96558
humanhash: oxygen-lithium-ack-tennessee
File name:Soft.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:3'320'096 bytes
First seen:2025-06-24 17:25:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c919e586b47b1d38ff6ebeebdb083996 (7 x GCleaner)
ssdeep 49152:Dl+xkViKgZyR5Hhq7YbDXZl+evg52YGhAVbpk5pvXQxJLShjFWXhZO0QuLz:Dl+x3Ku0vCOf+ev0uWcVQbShjmF5Lz
TLSH T162E5F12555F51E32F231273A4DBD1BE5A0ADBE880F585C523AFB2D01EAFABEC2445143
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter aachum
Tags:exe gcleaner


Avatar
iamaachum
https://file-download.eu/Download.html => https://mega.nz/folder/aUFGSKYC#AHolx-tMktDozO_GO-61Lw

GCleaner C2: 185.156.72.196

Intelligence

File Origin
# of uploads :
1
# of downloads :
501
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Soft.exe
Verdict:
Malicious activity
Analysis date:
2025-06-24 17:24:29 UTC
Tags:
delphi gcleaner loader auto socks5systemz proxybot botnet inno installer golang
Link:
https://app.any.run/tasks/77a8a488-61d0-421e-858f-17a7ddd2e322

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10954/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader48.41005.16884.15552.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685adf4cb06783b9ebd6f102
Tags:
delphi emotet cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Unauthorized injection to a recently created process by context flags manipulation
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi entropy expired-cert fingerprint invalid-signature keylogger packed packed packer_detected signed
Link:
https://www.filescan.io/uploads/685ae022f8f8abe4f8b87304/reports/bde8f08b-b2e2-49db-a4ea-fc95f91d891d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
Malware family:
RealVNC
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5ef20af1-e6c9-4298-b640-2c54402af2d5
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1722124
Signature
Antivirus detection for dropped file
Found hidden mapped module (file has been removed from disk)
Found stalling execution ending in API Sleep call
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/f81a62e066a6ffdbcfdae281aef96558
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-06-24 17:24:31 UTC
File Type:
PE (Exe)
Extracted files:
36
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbgnwki4iadhmeayxbgayaxtpl57uc2ry27qeiddtk6jd52abgyq._file
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner discovery loader
Link:
https://tria.ge/reports/250624-vz4kmscl6x/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
GCleaner
Gcleaner family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d8e6b566-8929-4cc3-98a3-dc07ad1a35dd
Unpacked files
SH256 hash:
384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
MD5 hash:
f81a62e066a6ffdbcfdae281aef96558
SHA1 hash:
f5858ef634c482e050968217da72d0d94f9ec357
Link:
https://www.unpac.me/results/3839f9d2-f07a-4ad4-816f-ac2d3d8ca187/
SH256 hash:
5a5ed78e04c7ad144a4580c19e9743d252b4a25e84ba7e6c4c43fc459c956a9a
MD5 hash:
8aadb7e2a4e0128b357b6e90d924d128
SHA1 hash:
cfc4678d82f0e4b0cebd1fb0b01f479dc25134d5
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/3839f9d2-f07a-4ad4-816f-ac2d3d8ca187/
Parent samples :
2046f265e025776e7199a9e576be5ed49483841f5203c3e3eeb79d0a24f73920
384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
768f9ecc19a84b15234ead8058f24a9c8a337430312eab9ecbbcbfa8ab69d0f3
aba7585008a92523b09b28c94fdd8fb7afc39b5b466efac8ca5f7f2b520bbedd
ca4a5fcd9eff405f9f8037e89e1a72914eda7129e5aa9476283021c03c56500c
c5e135c050b4ecbc73acae15b6dbbfaf5157e60fe62c96913b4c56df77ae4feb
dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
c582323df2a900ae3b0b1860ff768aa5e90f3e595b33aecb57040b130a65e632
e65f22bbb7a32f6fd436eb0ea6de0c000542ffd6785a983d8f0594b791331994
70cc21383260ea0cb520627324853ae7665cb4b8f6462c5a96e07375a2c26317
3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
408ef63acd027f6ba843e30d00d51e506d714804ee842a83f4f31a4b5d7aa7d9
f62ad9ecb4facb02dead75e27e29db58519b6805f49278852d02298b55e59cf5
758e36455c17152210a6ae8001e3b9d7680159440e0e6ae702b9302ec2160d50
a91a863821ef21472adfeeed5e90eebf3fe5e559f257f7d37de401c2a0553485
8b2d9358a329089c3bd96cce97b91e9b8a4d900abd0aaa8e55c3c0466e930c88
9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3
e41b1aa6ff791b7611638851db2ba42c47a125a81b5c74d10354f4f87d4e8770
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
05664da4d3ea8b39b6183a1112e67f46a8715536faa0a9469bc2659f4ef16289
d3a77d8bcd9963d30fd3e51acee6654e3ccbf2b2b81fbe47e97b9b9068c76f06
1a757566caa5edd32fd5c190b9e8da7d7abf3398b9a3ceddd365a95886434767
53afe13ca6d157bec8b1cc467764abd1194fb3bbd06c0a67a2ee5f560b63d1a4
82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
512b629f01ce1668bcc60ea305e93fb264cf2b7f2f87bb3aafef29beeb604cce
cc261502042db67adb917ce03321ee47277cfbc1712b770c6b71c035b89793cb
477df2a52197bd71524c4ccf192ce2d2afb8b4b3d8e33f8efa418910342f30e7
a53952ad1b88e5d6b4fc14f09e4ccd0f2ce4be72df7c5693abd8cdad953a4871
5dfcdc1c491fbf2f7f2fbac6bbf27b84be652583b66b252c46e8ed86577c3c60
SH256 hash:
0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c
MD5 hash:
4ce3ce196eda86d92b68362b6269b618
SHA1 hash:
fd42ee0aca0315acac25c297f1ce33634c549559
Link:
https://www.unpac.me/results/3839f9d2-f07a-4ad4-816f-ac2d3d8ca187/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/384cdb291c40/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1

(this sample)

  
Link
https://tria.ge/250624-vw74navqy3/behavioral1
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/10954/

Comments