MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 15


Intelligence 15 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
SHA3-384 hash: 96f025d5db557c7983fa8499f074fa26bcbf9d48ee6d6574b652d540bd10d86a2e69493af7690de976da89002108ad4b
SHA1 hash: 221ae362e446157cad782c8679c9d32694219f0c
MD5 hash: e042efc88d73ed41a4b6a727450e8a41
humanhash: florida-finch-three-cardinal
File name:Soft.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:3'364'640 bytes
First seen:2025-08-01 17:31:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 35fb237fb0cbb96f5c18921de1853d20 (13 x GCleaner)
ssdeep 49152:LM3dDmMd8YOvwcLt+oMHOxrOuZ+bv4eLlFjRUgOeQSerCEGSZxzrkWfB+5:LM3dDiLzeOSQeLHRUgLQaEGkrkZ
TLSH T125F5F1CBB8D37074D3256B3C2905DA688D52D78A9BB74B033CE8C7D891BC5B91F21686
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter aachum
Tags:exe gcleaner


Avatar
iamaachum
https://download-trust.eu//Download.html => https://mega.nz/folder/jtg1DSqR#KARWjGq6m4hNelDO0L-lIQ

GCleaner C2: 176.46.158.23

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Soft.exe
Verdict:
Malicious activity
Analysis date:
2025-08-01 17:39:22 UTC
Tags:
gcleaner loader
Link:
https://app.any.run/tasks/8e6b5d54-4e25-4f32-926c-aefc72e9f327

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18349/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688cfb280b4775fb2134b176
Tags:
delphi emotet cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Connection attempt to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint invalid-signature keylogger obfuscated packed packed packer_detected signed
Link:
https://www.filescan.io/uploads/688cfa2e32e61090868a7261/reports/84df36e0-faef-4b19-833b-abd051fa9e92/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
Malware family:
RealVNC
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/dcefb2c1-00c0-4e1b-8171-b1f49b041e5c
Result
Threat name:
CryptOne, GCleaner, GO Injector, LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1748641
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates / moves files in alternative data streams (ADS)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files with a suspicious file extension
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found strings related to Crypto-Mining
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Potentially Suspicious Child Process Of Regsvr32
Sigma detected: Powershell launch regsvr32
Sigma detected: Search for Antivirus process
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected GO Injector
Yara detected LummaC Stealer
Yara detected Socks5Systemz
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1748641 Sample: Soft.exe Startdate: 01/08/2025 Architecture: WINDOWS Score: 100 125 185.156.73.98 RELDAS-NETRU Russian Federation 2->125 127 45.91.200.135 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Netherlands 2->127 129 15 other IPs or domains 2->129 145 Found malware configuration 2->145 147 Malicious sample detected (through community Yara rule) 2->147 149 Antivirus detection for dropped file 2->149 151 17 other signatures 2->151 14 Soft.exe 2 2->14         started        18 regsvr32.exe 2->18         started        signatures3 process4 file5 115 C:\Users\user\AppData\...\svchost015.exe, PE32 14->115 dropped 117 C:\Users\user\AppData\Local\...\svc4CB4.tmp, PE32 14->117 dropped 163 Writes to foreign memory regions 14->163 165 Found hidden mapped module (file has been removed from disk) 14->165 20 svchost015.exe 31 14->20         started        24 Stating.com 14->24         started        27 extrac32.exe 18 14->27         started        31 3 other processes 14->31 29 regsvr32.exe 18->29         started        signatures6 process7 dnsIp8 131 drive.usercontent.google.com 142.251.40.129, 443, 49686 GOOGLEUS United States 20->131 133 176.46.158.23, 49690, 49693, 49694 ESTPAKEE Iran (ISLAMIC Republic Of) 20->133 91 C:\Users\user\AppData\...\4bKv7cTIv.exe, PE32 20->91 dropped 93 C:\Users\user\AppData\...\rp7KNjKX666A.exe, PE32 20->93 dropped 95 C:\Users\user\AppData\...\jgtbHqKcs.exe, PE32 20->95 dropped 97 3 other malicious files 20->97 dropped 33 4bKv7cTIv.exe 2 20->33         started        36 jgtbHqKcs.exe 20->36         started        38 rp7KNjKX666A.exe 25 20->38         started        135 gavavknq.beer 172.67.190.65, 443, 49696, 49698 CLOUDFLARENETUS United States 24->135 153 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 24->153 155 Query firmware table information (likely to detect VMs) 24->155 157 Tries to harvest and steal ftp login credentials 24->157 159 3 other signatures 24->159 file9 signatures10 process11 file12 75 C:\Users\user\AppData\Local\...\4bKv7cTIv.tmp, PE32 33->75 dropped 40 4bKv7cTIv.tmp 18 26 33->40         started        77 C:\Users\user\AppData\Local\...\jgtbHqKcs.tmp, PE32 36->77 dropped 43 jgtbHqKcs.tmp 36->43         started        79 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 38->79 dropped 45 cmd.exe 1 38->45         started        process13 file14 99 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 40->99 dropped 101 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 40->101 dropped 103 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 40->103 dropped 107 21 other malicious files 40->107 dropped 48 filecomparebox4599.exe 40->48         started        105 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 43->105 dropped 52 jgtbHqKcs.exe 43->52         started        161 Drops PE files with a suspicious file extension 45->161 54 cmd.exe 4 45->54         started        56 conhost.exe 45->56         started        signatures15 process16 dnsIp17 121 66.63.187.153, 443, 49923, 49967 ASN-QUADRANET-GLOBALUS United States 48->121 123 89.105.201.183, 2024, 50003, 50142 NOVOSERVE-ASNL Netherlands 48->123 81 C:\ProgramData\FileCompareBox\sqlite3.dll, PE32 48->81 dropped 83 C:\ProgramData\...\FileCompareBox.exe, PE32 48->83 dropped 85 C:\Users\user\AppData\Local\...\jgtbHqKcs.tmp, PE32 52->85 dropped 58 jgtbHqKcs.tmp 52->58         started        87 C:\Users\user\AppData\Local\...\Stating.com, PE32 54->87 dropped 89 C:\Users\user\AppData\Local\Temp\564625\S, data 54->89 dropped file18 process19 file20 109 C:\Users\user\AppData\Local\is-495T3.tmp, PE32 58->109 dropped 111 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 58->111 dropped 113 C:\Users\user\...\3LightGray.pfx (copy), PE32 58->113 dropped 61 regsvr32.exe 58->61         started        process21 dnsIp22 137 177.150.96.191.bl.spamcop.net 61->137 139 quag.cn 185.185.68.112, 443, 49706 SPRINTHOSTRU Russian Federation 61->139 141 11 other IPs or domains 61->141 119 C:\Users\user:.repos, data 61->119 dropped 167 System process connects to network (likely due to code injection or exploit) 61->167 169 Suspicious powershell command line found 61->169 171 Creates / moves files in alternative data streams (ADS) 61->171 173 Found strings related to Crypto-Mining 61->173 66 powershell.exe 61->66         started        69 powershell.exe 61->69         started        file23 signatures24 process25 signatures26 143 Loading BitLocker PowerShell Module 66->143 71 conhost.exe 66->71         started        73 conhost.exe 69->73         started        process27
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/e042efc88d73ed41a4b6a727450e8a41
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b/
Verdict:
Malicious
Threat:
Family.GCLEANER
Link:
https://tip.neiki.dev/file/3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-08-01 17:32:17 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hrgnmcylz44bx7pk4i4xvyqbcalndu4j34glkjgv4evmtlvf44nq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250801-v4cygsek8y/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9317458e-ca00-43d1-b419-a1b7c645f5b5
Unpacked files
SH256 hash:
3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
MD5 hash:
e042efc88d73ed41a4b6a727450e8a41
SHA1 hash:
221ae362e446157cad782c8679c9d32694219f0c
Link:
https://www.unpac.me/results/0ddf719e-ddba-49d1-b681-8db333567a67/
SH256 hash:
5a5ed78e04c7ad144a4580c19e9743d252b4a25e84ba7e6c4c43fc459c956a9a
MD5 hash:
8aadb7e2a4e0128b357b6e90d924d128
SHA1 hash:
cfc4678d82f0e4b0cebd1fb0b01f479dc25134d5
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/0ddf719e-ddba-49d1-b681-8db333567a67/
Parent samples :
2046f265e025776e7199a9e576be5ed49483841f5203c3e3eeb79d0a24f73920
384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
768f9ecc19a84b15234ead8058f24a9c8a337430312eab9ecbbcbfa8ab69d0f3
aba7585008a92523b09b28c94fdd8fb7afc39b5b466efac8ca5f7f2b520bbedd
ca4a5fcd9eff405f9f8037e89e1a72914eda7129e5aa9476283021c03c56500c
c5e135c050b4ecbc73acae15b6dbbfaf5157e60fe62c96913b4c56df77ae4feb
dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
c582323df2a900ae3b0b1860ff768aa5e90f3e595b33aecb57040b130a65e632
e65f22bbb7a32f6fd436eb0ea6de0c000542ffd6785a983d8f0594b791331994
70cc21383260ea0cb520627324853ae7665cb4b8f6462c5a96e07375a2c26317
3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
408ef63acd027f6ba843e30d00d51e506d714804ee842a83f4f31a4b5d7aa7d9
f62ad9ecb4facb02dead75e27e29db58519b6805f49278852d02298b55e59cf5
758e36455c17152210a6ae8001e3b9d7680159440e0e6ae702b9302ec2160d50
a91a863821ef21472adfeeed5e90eebf3fe5e559f257f7d37de401c2a0553485
8b2d9358a329089c3bd96cce97b91e9b8a4d900abd0aaa8e55c3c0466e930c88
9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3
e41b1aa6ff791b7611638851db2ba42c47a125a81b5c74d10354f4f87d4e8770
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
05664da4d3ea8b39b6183a1112e67f46a8715536faa0a9469bc2659f4ef16289
d3a77d8bcd9963d30fd3e51acee6654e3ccbf2b2b81fbe47e97b9b9068c76f06
1a757566caa5edd32fd5c190b9e8da7d7abf3398b9a3ceddd365a95886434767
53afe13ca6d157bec8b1cc467764abd1194fb3bbd06c0a67a2ee5f560b63d1a4
82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
512b629f01ce1668bcc60ea305e93fb264cf2b7f2f87bb3aafef29beeb604cce
cc261502042db67adb917ce03321ee47277cfbc1712b770c6b71c035b89793cb
477df2a52197bd71524c4ccf192ce2d2afb8b4b3d8e33f8efa418910342f30e7
a53952ad1b88e5d6b4fc14f09e4ccd0f2ce4be72df7c5693abd8cdad953a4871
5dfcdc1c491fbf2f7f2fbac6bbf27b84be652583b66b252c46e8ed86577c3c60
SH256 hash:
0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c
MD5 hash:
4ce3ce196eda86d92b68362b6269b618
SHA1 hash:
fd42ee0aca0315acac25c297f1ce33634c549559
Link:
https://www.unpac.me/results/0ddf719e-ddba-49d1-b681-8db333567a67/
Malware family:
Tofsee
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3c4cd60b0bcf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b

(this sample)

  
Link
https://tria.ge/250801-vkqp8s1tcy/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/18349/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments