🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 12


Intelligence 12 IOCs YARA 28 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34
SHA3-384 hash: 2e339adc17bf560c9bcd5f42883299a8a53e7bc0c6d29815e63c88f46897b4431c634f0e1b9d20cdf1c21f30d18c8a47
SHA1 hash: 800c890a3a8396c10ef8098886c6d8c46e594911
MD5 hash: bfb8db9df49d8719b744321349af97b8
humanhash: pasta-montana-johnny-lithium
File name:file.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:663'824 bytes
First seen:2026-10-13 06:21:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash c4e958372c5ed19e596806cf28b926e1 (2 x GCleaner)
ssdeep 12288:S+DkHFnLCA5mXX0tEo8mB1tqGQ6vVIX1Ndkp2SgdMQ0NxL53284:JgZnU0tmEnvVIneB+M1w
TLSH T1BCE48E26B2E0E532D1631E388D5BE2799C3A7E413928986E2EE85D4C7F3464134673F7
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (573 x Quakbot, 334 x GCleaner, 137 x ArkeiStealer)
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34
Verdict:
Malicious activity
Analysis date:
2026-10-12 20:51:59 UTC
Tags:
gcleaner loader auto generic
Link:
https://app.any.run/tasks/a3fe1cf7-7b6b-4d05-9338-2e03052988aa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91634/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
DNS request
Sending a custom TCP request
Connection attempt
Deleting a recently created file
Connection attempt to an infection source
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-12T11:57:00Z UTC
Last seen:
2026-10-12T15:25:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/df34e7de-b513-48eb-9f89-62f6180be70a
Result
Threat name:
Amadey, CryptOne, GCleaner, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1986313
Signature
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to inject code into remote processes
Detected unpacking (creates a PE file in dynamic memory)
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Disable power options
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Stop EventLog
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sleep reduction / modifications
Tries to harvest and steal Bitcoin Wallet information
Unusual module load detection (module proxying)
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1986313 Sample: file.exe Startdate: 13/10/2026 Architecture: WINDOWS Score: 100 100 45.91.200.135 PODAONLV Netherlands 2->100 102 185.156.73.98 FDN3UA Russia 2->102 104 drive.usercontent.google.com 2->104 132 Suricata IDS alerts for network traffic 2->132 134 Found malware configuration 2->134 136 Antivirus detection for URL or domain 2->136 138 25 other signatures 2->138 14 file.exe 2->14         started        17 powershell.exe 2->17         started        19 svchost.exe 1 1 2->19         started        22 7 other processes 2->22 signatures3 process4 dnsIp5 156 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 14->156 158 Hijacks the control flow in another process 14->158 160 Contains functionality to inject code into remote processes 14->160 170 2 other signatures 14->170 24 svchost.exe 70 14->24         started        162 Writes to foreign memory regions 17->162 164 Modifies the context of a thread in another process (thread injection) 17->164 166 Injects a PE file into a foreign processes 17->166 29 conhost.exe 17->29         started        106 127.0.0.1 unknown unknown 19->106 168 Unusual module load detection (module proxying) 19->168 31 conhost.exe 22->31         started        signatures6 process7 dnsIp8 110 91.92.242.236, 49717, 49737, 80 OMEGATECH-ASSC Netherlands 24->110 112 drive.usercontent.google.com 142.251.45.193, 443, 49710 GOOGLE-GoogleLLCUS United States 24->112 90 C:\Users\user\AppData\...\HPmP8Pjdg.exe, PE32+ 24->90 dropped 92 C:\Users\user\AppData\...\DFOsW9uE6E8.exe, PE32+ 24->92 dropped 94 C:\Users\user\AppData\...\oZSANNLWdNLUy.exe, PE32+ 24->94 dropped 96 22 other malicious files 24->96 dropped 148 System process connects to network (likely due to code injection or exploit) 24->148 150 Suspicious powershell command line found 24->150 152 Unusual module load detection (module proxying) 24->152 33 uRo5KgUqS.exe 24->33         started        36 SGnuQ7Q0P9E.exe 24->36         started        39 gD9O1BkSEbpT.exe 24->39         started        41 6 other processes 24->41 file9 signatures10 process11 dnsIp12 114 Multi AV Scanner detection for dropped file 33->114 116 Suspicious powershell command line found 33->116 118 Uses powercfg.exe to modify the power settings 33->118 128 4 other signatures 33->128 43 uRo5KgUqS.exe 33->43         started        108 45.74.7.192, 49724, 56001 OMEGATECH-ASSC United Kingdom 36->108 120 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 36->120 122 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 36->122 124 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 36->124 130 4 other signatures 36->130 126 Detected unpacking (creates a PE file in dynamic memory) 39->126 46 conhost.exe 41->46         started        48 conhost.exe 41->48         started        50 conhost.exe 41->50         started        52 3 other processes 41->52 signatures13 process14 signatures15 154 Suspicious powershell command line found 43->154 54 powershell.exe 12 43->54         started        process16 signatures17 140 Found suspicious powershell code related to unpacking or dynamic code loading 54->140 57 uRo5KgUqS.exe 54->57         started        60 conhost.exe 54->60         started        process18 signatures19 142 Modifies the context of a thread in another process (thread injection) 57->142 144 Injects a PE file into a foreign processes 57->144 146 Found direct / indirect Syscall (likely to bypass EDR) 57->146 62 uRo5KgUqS.exe 57->62         started        process20 file21 98 C:\ProgramData\...\xfxylswnnkzq.exe, PE32+ 62->98 dropped 172 Modifies the context of a thread in another process (thread injection) 62->172 174 Adds a directory exclusion to Windows Defender 62->174 176 Modifies power options to not sleep / hibernate 62->176 66 cmd.exe 62->66         started        68 powershell.exe 62->68         started        70 sc.exe 62->70         started        72 12 other processes 62->72 signatures22 process23 process24 74 conhost.exe 66->74         started        76 wusa.exe 66->76         started        78 conhost.exe 68->78         started        80 conhost.exe 70->80         started        82 conhost.exe 72->82         started        84 conhost.exe 72->84         started        86 conhost.exe 72->86         started        88 6 other processes 72->88
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/bfb8db9df49d8719b744321349af97b8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2026-10-12 15:47:45 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h2b6wcig2teor6kcmpj7wujhcrrdqjk6mj2ifxtv746tvcxgvy2a._file
Verdict:
malicious
Label(s):
ADMINTOOL_AutoHotkey
Create hunting rule
Amadey
Create hunting rule
OverlordRAT
Create hunting rule
Link:
https://reports.threatray.com/96a19a2f-9156-408e-b61f-780cb4770b0b
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner defense_evasion discovery execution loader persistence privilege_escalation spyware stealer
Link:
https://tria.ge/reports/261013-g41snax18m/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Direct Volume Access: Opens a physical disk for reading
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Contacts third-party web service commonly abused for C2
Enumerates connected drives
Power Settings
Creates new service(s)
Executes dropped EXE
Reads user/profile data of web browsers
Stops running service(s)
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Family: GCleaner
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
185.156.73.98
Unpacked files
SH256 hash:
3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34
MD5 hash:
bfb8db9df49d8719b744321349af97b8
SHA1 hash:
800c890a3a8396c10ef8098886c6d8c46e594911
Link:
https://www.unpac.me/results/8a8b869e-f040-4efd-bda2-238f4aaec458/
SH256 hash:
957f1fcb8c88a52c244a1dfa6fea83c8916ef47a1eebbd724a638a76179e7224
MD5 hash:
5ad50b34ce2c93a7b1bc6e5432cf862e
SHA1 hash:
ad6a864994add333c920a1b9931d161b753b3176
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/8a8b869e-f040-4efd-bda2-238f4aaec458/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_SliverFox_ForgeAuto_c1e18461
Create hunting rule
Author:Marjoriefort
Description:Detects SliverFox (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4286e0e1_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_598a7881_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_99cdfd72_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_bd254b5c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 3e83eb0906d4c8e8f94263d3fb5127146238255e627482de75ff3d3a8ae6ae34

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3913054/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/91634/

Comments