MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fdf21f7ad2430c552a8dc34c6fbaf82d95a0f44b9a7bd514d89ad3d074d345f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fdf21f7ad2430c552a8dc34c6fbaf82d95a0f44b9a7bd514d89ad3d074d345f
SHA3-384 hash: 47121247af508586fd5c3c52f88c692e16d3ddb80be1cff7a6d1e65a9151e8cdc9ed4ed9a80df665d6baa05cd42268be
SHA1 hash: bd3ab93a28c9229018c3e80998ae30c6a1463416
MD5 hash: afb53ed8919416e84de41add492e5e45
humanhash: florida-alanine-edward-lake
File name:afb53ed8919416e84de41add492e5e45.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:1'630'208 bytes
First seen:2022-01-01 10:45:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9734ba8626408cec04bb8fa7d8bb6e83 (4 x PrivateLoader, 3 x GCleaner, 2 x RedLineStealer)
ssdeep 24576:N7ww87NKA/lL60S/wOBlkZsqjnhMgeiCl7G0nehbGZpbD:NwtNf9u0SJBlkdDmg27RnWGj
TLSH T13C75D034E201F026F4F20435EC9DD7BA64286B30675458EBF3D65EA9A7B1AD1D230B27
Reporter abuse_ch
Tags:exe gcleaner


Avatar
abuse_ch
GCleaner C2:
185.215.113.10:32605

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.10:32605 https://threatfox.abuse.ch/ioc/290190/

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
afb53ed8919416e84de41add492e5e45.exe
Verdict:
No threats detected
Analysis date:
2022-01-01 10:49:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3a343371-fc4c-413f-82a2-e8a2563052b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216992/
Detection(s):
PUA.Win.Packer.Pequake-4
Create hunting rule

Win.Dropper.Xpiro-9918730-1
Create hunting rule

Win.Dropper.Xpiro-9918731-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Creating a file in the Program Files subdirectories
Creating a file
Сreating synchronization primitives
Creating a process from a recently created file
Launching a process
Creating a process with a hidden window
Sending an HTTP GET request to an infection source
Sending an HTTP POST request to an infection source
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint greyware virus virut
Link:
https://www.filescan.io/uploads/61d030ee8991ba72b3a3e324/reports/018e1648-92ff-47f5-a6d3-ba8422dbafab/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d8f942f-d65d-4732-9269-792bb2cce473
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/914438
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates HTML files with .exe extension (expired dropper behavior)
Creates processes via WMI
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected SmokeLoader
Yara detected WebBrowserPassView password recovery tool
Yara Genericmalware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546916 Sample: 7WQadnF0l1.exe Startdate: 01/01/2022 Architecture: WINDOWS Score: 100 145 Antivirus detection for URL or domain 2->145 147 Antivirus detection for dropped file 2->147 149 Multi AV Scanner detection for dropped file 2->149 151 13 other signatures 2->151 8 7WQadnF0l1.exe 18 2->8         started        13 PowerControl_Svc.exe 15 2->13         started        15 PowerControl_Svc.exe 16 2->15         started        process3 dnsIp4 131 149.154.167.99 TELEGRAMRU United Kingdom 8->131 133 212.193.30.29 SPD-NETTR Russian Federation 8->133 139 4 other IPs or domains 8->139 89 C:\Users\...\PXnaDx2DiOhbQHCuUE8NDBxn.exe, PE32 8->89 dropped 91 C:\Users\user\AppData\...\Cube_WW14[1].bmp, PE32 8->91 dropped 93 C:\...\PowerControl_Svc.exe, PE32 8->93 dropped 95 C:\...\PowerControl_Svc.exe:Zone.Identifier, ASCII 8->95 dropped 167 Drops PE files to the document folder of the user 8->167 169 Uses schtasks.exe or at.exe to add and modify task schedules 8->169 17 PXnaDx2DiOhbQHCuUE8NDBxn.exe 4 37 8->17         started        22 schtasks.exe 1 8->22         started        24 schtasks.exe 1 8->24         started        135 104.26.4.15 CLOUDFLARENETUS United States 13->135 137 172.67.75.166 CLOUDFLARENETUS United States 13->137 97 C:\Users\...\s80_R64nhAROjIqqQUlTLARm.exe, PE32 13->97 dropped 26 s80_R64nhAROjIqqQUlTLARm.exe 37 13->26         started        28 schtasks.exe 13->28         started        30 schtasks.exe 13->30         started        99 C:\Users\...\IYWms80_R64nhAROjIqqQUlT.exe, PE32 15->99 dropped 101 C:\Users\user\AppData\...\Cube_WW14[2].bmp, PE32 15->101 dropped 32 IYWms80_R64nhAROjIqqQUlT.exe 1 15->32         started        34 schtasks.exe 1 15->34         started        36 schtasks.exe 1 15->36         started        file5 signatures6 process7 dnsIp8 113 199.188.201.89 NAMECHEAP-NETUS United States 17->113 115 148.251.234.93 HETZNER-ASDE Germany 17->115 121 9 other IPs or domains 17->121 65 C:\Users\...\zmswmxHLrj2GKKnCh7dMmzLU.exe, PE32 17->65 dropped 67 C:\Users\...\uX7iBhrVGLAx449m3Tn_sEzu.exe, PE32 17->67 dropped 69 C:\Users\...\sLIAfbmjROsx67MrlnwDFg2r.exe, PE32+ 17->69 dropped 77 13 other files (10 malicious) 17->77 dropped 153 Creates HTML files with .exe extension (expired dropper behavior) 17->153 155 Disable Windows Defender real time protection (registry) 17->155 52 10 other processes 17->52 38 conhost.exe 22->38         started        40 conhost.exe 24->40         started        117 104.21.59.236 CLOUDFLARENETUS United States 26->117 119 104.23.98.190 CLOUDFLARENETUS United States 26->119 123 6 other IPs or domains 26->123 71 C:\Users\...\b2y00ZHZopx8sqpgTaFUklNk.exe, PE32+ 26->71 dropped 73 C:\Users\user\AppData\Local\...\setup[1].exe, PE32 26->73 dropped 75 C:\Users\user\AppData\...\rtst1053[1].exe, PE32+ 26->75 dropped 79 13 other files (5 malicious) 26->79 dropped 157 Detected unpacking (creates a PE file in dynamic memory) 26->157 159 Tries to harvest and steal browser information (history, passwords, etc) 26->159 57 2 other processes 26->57 42 conhost.exe 28->42         started        44 conhost.exe 30->44         started        46 conhost.exe 32->46         started        48 conhost.exe 34->48         started        50 conhost.exe 36->50         started        file9 signatures10 process11 dnsIp12 125 208.95.112.1 TUT-ASUS United States 52->125 127 148.251.234.83 HETZNER-ASDE Germany 52->127 129 2 other IPs or domains 52->129 81 C:\Users\...\pidHTSIGEi8DrAmaYu9K8ghN89.dll, PE32+ 52->81 dropped 83 C:\Users\...\uX7iBhrVGLAx449m3Tn_sEzu.tmp, PE32 52->83 dropped 85 C:\Users\...\50R7nX726zcx8Zw4hBhaFdZB.tmp, PE32 52->85 dropped 87 2 other malicious files 52->87 dropped 161 Obfuscated command line found 52->161 163 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 52->163 165 Checks if the current machine is a virtual machine (disk enumeration) 52->165 59 50R7nX726zcx8Zw4hBhaFdZB.tmp 52->59         started        63 nTcH3ljB18e39VyMC_ebfR1N.exe 52->63         started        file13 signatures14 process15 dnsIp16 141 151.115.10.1 OnlineSASFR United Kingdom 59->141 103 C:\Users\user\AppData\...\Bouderbela.exe, PE32 59->103 dropped 105 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 59->105 dropped 107 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 59->107 dropped 109 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 59->109 dropped 143 172.67.143.210 CLOUDFLARENETUS United States 63->143 111 C:\Users\user\AppData\Local\Temp\sqlite.dll, PE32 63->111 dropped file17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fdf21f7ad2430c552a8dc34c6fbaf82d95a0f44b9a7bd514d89ad3d074d345f/
Threat name:
Win32.Trojan.Xpirat
Create hunting rule
Status:
Malicious
First seen:
2021-12-30 11:25:51 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
30 of 43 (69.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h7psd55neqymkuvi3q2mn65pqlmvud2exgt32uknrgwt2b2ngrpq._file
Verdict:
malicious
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader family:xmrig backdoor evasion miner spyware stealer suricata trojan
Link:
https://tria.ge/reports/220101-mtzqhagafp/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
NirSoft WebBrowserPassView
Nirsoft
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
SmokeLoader
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
xmrig
Malware Config
C2 Extraction:
http://melchen-testet.at/upload/
http://zjymf.com/upload/
http://pbxbmu70275.cn/upload/
http://mnenenravitsya.ru/upload/
http://pitersprav.ru/upload/
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Unpacked files
SH256 hash:
4423ca247499b84bb1f46e3b7d63148c0f3d65922f09c5fac5e0ebaf5ce9be6a
MD5 hash:
c144b75b47a97443284c71e0c99b99fe
SHA1 hash:
ec08b62f60368c1370cdbc8271371209c455b551
Link:
https://www.unpac.me/results/bb6a9eeb-c220-46e5-9a7e-77cd6c5f2e0f/
SH256 hash:
315b65519cec456a57b508ad354275cd4f1b302411491c8aa72dafae30749cf9
MD5 hash:
405baf3ff9d887d4602663433dbc7538
SHA1 hash:
9cbe747fd19552d5953fcc3473a969c22e31b902
Link:
https://www.unpac.me/results/bb6a9eeb-c220-46e5-9a7e-77cd6c5f2e0f/
SH256 hash:
3fdf21f7ad2430c552a8dc34c6fbaf82d95a0f44b9a7bd514d89ad3d074d345f
MD5 hash:
afb53ed8919416e84de41add492e5e45
SHA1 hash:
bd3ab93a28c9229018c3e80998ae30c6a1463416
Link:
https://www.unpac.me/results/bb6a9eeb-c220-46e5-9a7e-77cd6c5f2e0f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3fdf21f7ad24/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_DLInjector06
Create hunting rule
Author:ditekSHen
Description:Detects downloader / injector

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/216992/

Comments