🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 14


Intelligence 14 IOCs YARA 29 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec
SHA3-384 hash: d6a83347ae6952e35698e7ad40a5acda81414e64c23c894182a18c1df6f63d6a4cb26b56a9599e4c0c9e1fcb139ec603
SHA1 hash: c4404f65fe9d57709f0a0387fe1dd741e1b8fbc3
MD5 hash: 8d1d55cdb009796323a6ffe8c3403795
humanhash: cup-fruit-carolina-avocado
File name:45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:889'616 bytes
First seen:2026-10-10 00:03:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash a2a56703d1bd4c26d0b3dd2818f42708 (2 x GCleaner)
ssdeep 12288:38HP9Y4KGqMo0LUwrbLTGH6uYx8BPnspv1+fOdgSzXLaM0NMALFx9ERveU:3ei8qKLUwrbLKT3B4IRSDglLL9E1R
TLSH T15E158D12A3D34833C1B32ABC5D1B86549B2ABF022937D9462BF51E4C6F352593B36397
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (573 x Quakbot, 332 x GCleaner, 137 x ArkeiStealer)
Reporter whack_sh
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec
Verdict:
Malicious activity
Analysis date:
2026-10-09 20:38:44 UTC
Tags:
gcleaner loader auto generic
Link:
https://app.any.run/tasks/6f359fab-bad2-4466-a909-73a950991ce5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91282/
Detection(s):
SecuriteInfo.com.Trojan.Inject7.4856.10607.15058.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Deleting a recently created file
Connection attempt to an infection source
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi expired-cert fingerprint installer-heuristic invalid-signature keylogger packed signed
Link:
https://www.filescan.io/uploads/6ac98102c7b121d141e9a946/reports/b3acde8b-76e3-4042-b4ab-c45c8b5fe0e1/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-09T10:16:00Z UTC
Last seen:
2026-10-11T18:01:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f5cb0fb2-5d3a-4ff1-be59-3c77bf7af560
Result
Threat name:
CryptOne, GCleaner, Salat Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1985178
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Drops executable to a common third party application directory
Drops PE files with benign system names
Encrypted powershell cmdline option found
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Hijacks the control flow in another process
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies power options to not sleep / hibernate
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Disable power options
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Stop EventLog
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect sleep reduction / modifications
Tries to harvest and steal Bitcoin Wallet information
Unusual module load detection (module proxying)
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected MSIL Injector
Yara detected Salat Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1985178 Sample: K8uC2tvboL.exe Startdate: 10/10/2026 Architecture: WINDOWS Score: 100 112 45.91.200.135 PODAONLV Netherlands 2->112 114 185.156.73.98 FDN3UA Russia 2->114 116 7 other IPs or domains 2->116 132 Suricata IDS alerts for network traffic 2->132 134 Found malware configuration 2->134 136 Malicious sample detected (through community Yara rule) 2->136 138 14 other signatures 2->138 11 K8uC2tvboL.exe 2->11         started        14 NRcwrukCQ.exe 2->14         started        16 svchost.exe 2->16 injected 18 6 other processes 2->18 signatures3 process4 signatures5 156 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->156 158 Hijacks the control flow in another process 11->158 160 Contains functionality to inject code into remote processes 11->160 162 4 other signatures 11->162 20 svchost.exe 70 11->20         started        25 NRcwrukCQ.exe 14->25         started        27 consent.exe 16->27         started        process6 dnsIp7 118 91.92.242.236, 49715, 80 OMEGATECH-ASSC Netherlands 20->118 120 drive.usercontent.google.com 192.178.155.132, 443, 49713 GOOGLE-GoogleLLCUS United States 20->120 88 C:\Users\user\AppData\...\uXkCLhPkms.exe, PE32+ 20->88 dropped 90 C:\Users\user\AppData\...\LthyREMiSOgS.exe, PE32 20->90 dropped 92 C:\Users\user\AppData\...\Xz7M7S6TPuWT.exe, PE32+ 20->92 dropped 94 22 other malicious files 20->94 dropped 140 System process connects to network (likely due to code injection or exploit) 20->140 142 Unusual module load detection (module proxying) 20->142 29 NRcwrukCQ.exe 20->29         started        32 GQGKUXTQsHtSo.exe 1 3 20->32         started        36 LthyREMiSOgS.exe 20->36         started        40 3 other processes 20->40 144 Found direct / indirect Syscall (likely to bypass EDR) 25->144 38 544f866d36c2b451432c524abb2d347c.exe 25->38         started        146 Writes to foreign memory regions 27->146 file8 signatures9 process10 dnsIp11 172 Multi AV Scanner detection for dropped file 29->172 174 Uses powercfg.exe to modify the power settings 29->174 176 Adds a directory exclusion to Windows Defender 29->176 184 3 other signatures 29->184 42 NRcwrukCQ.exe 29->42         started        108 94.26.90.170, 49721, 56001 DEDIK-IODEDIKSERVICESLIMITEDDEDIKIOGB Germany 32->108 84 C:\Users\user\AppData\...\dfdfsdggfgd.exe, PE32 32->84 dropped 178 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 32->178 180 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 32->180 182 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 32->182 186 5 other signatures 32->186 47 powershell.exe 32->47         started        86 C:\Users\user\AppData\...\LthyREMiSOgS.tmp, PE32 36->86 dropped 49 LthyREMiSOgS.tmp 36->49         started        110 127.0.0.1 unknown unknown 40->110 51 conhost.exe 40->51         started        53 conhost.exe 40->53         started        file12 signatures13 process14 dnsIp15 128 github.com 140.82.114.3, 443, 49723 GITHUB-GitHubIncUS United States 42->128 130 release-assets.githubusercontent.com 185.199.108.133, 443, 49724 FASTLY-FastlyIncUS United States 42->130 100 C:\...\544f866d36c2b451432c524abb2d347c.exe, PE32 42->100 dropped 102 C:\ProgramData\...\koydpfrviquw.exe, PE32+ 42->102 dropped 164 Creates multiple autostart registry keys 42->164 166 Adds a directory exclusion to Windows Defender 42->166 168 Found direct / indirect Syscall (likely to bypass EDR) 42->168 170 Modifies power options to not sleep / hibernate 42->170 55 544f866d36c2b451432c524abb2d347c.exe 42->55         started        60 powershell.exe 42->60         started        62 cmd.exe 42->62         started        66 13 other processes 42->66 64 conhost.exe 47->64         started        104 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 49->104 dropped 106 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 49->106 dropped file16 signatures17 process18 dnsIp19 122 sa1atik.cn 64.204.180.24 AS-BLAZINGSEO-BlazingSEOLLCUS Germany 55->122 124 dns.google 8.8.8.8 GOOGLE-GoogleLLCUS United States 55->124 126 cloudflare-dns.com 104.16.248.249 CLOUDFLARENET-CloudflareIncUS Canada 55->126 96 C:\Users\user\AppData\...\myvatX1mvJrUwc.exe, PE32 55->96 dropped 98 C:\Program Files (x86)\...\lsass.exe, PE32 55->98 dropped 148 Creates multiple autostart registry keys 55->148 150 Drops PE files with benign system names 55->150 152 Drops executable to a common third party application directory 55->152 154 Unusual module load detection (module proxying) 55->154 68 conhost.exe 60->68         started        70 WmiPrvSE.exe 60->70         started        72 conhost.exe 62->72         started        74 wusa.exe 62->74         started        76 conhost.exe 66->76         started        78 conhost.exe 66->78         started        80 conhost.exe 66->80         started        82 10 other processes 66->82 file20 signatures21 process22
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/8d1d55cdb009796323a6ffe8c3403795
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec/
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-10-09 16:42:25 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iw4mkbskslda5j2h4o65pw7cah7ik54ufqci6huuf2jdpy5zu3wa._file
Verdict:
malicious
Label(s):
MATCHBOIL
Create hunting rule
PureCrypter
Create hunting rule
Link:
https://reports.threatray.com/828ea769-ce82-402b-9a7f-cb90df5b41fa
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:gcleaner defense_evasion discovery execution installer loader persistence privilege_escalation spyware stealer trojan
Link:
https://tria.ge/reports/261010-acqp2sgt2x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Script User-Agent
Modifies system certificate store
Modifies data under HKEY_USERS
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Reads the TCP/IP host and domain name from the registry
Modifies trusted root certificate store through registry
Executes a command shell one-liner
Command and Scripting Interpreter: PowerShell
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Suspicious use of SetThreadContext
Drops file in System32 directory
Power Settings
Checks installed software on the system
Adds Run key to start application
Stops running service(s)
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Creates new service(s)
Downloads MZ/PE file
Suspicious use of NtCreateUserProcessOtherParentProcess
Family: GCleaner
Family: DonutLoader
Detects DonutLoader
Malware Config
C2 Extraction:
185.156.73.98
Unpacked files
SH256 hash:
45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec
MD5 hash:
8d1d55cdb009796323a6ffe8c3403795
SHA1 hash:
c4404f65fe9d57709f0a0387fe1dd741e1b8fbc3
Link:
https://www.unpac.me/results/20bbb517-2099-4cc9-b09c-1f98b675c05b/
SH256 hash:
b1dc8481474db77a571f1519794d8d4c26b5ad8ca737aa83db44decd3cce84a0
MD5 hash:
7a150399f7e678fd21933f89f0aa5328
SHA1 hash:
396394796ee759961dc003efb412daab4a1d0f27
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/20bbb517-2099-4cc9-b09c-1f98b675c05b/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/45b8c5064a92/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_SliverFox_ForgeAuto_c1e18461
Create hunting rule
Author:Marjoriefort
Description:Detects SliverFox (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4286e0e1_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_598a7881_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_99cdfd72_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_bd254b5c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 45b8c5064a92c60ea747e3bdd7dbe201fe8577942c048f1e942e9237e3b9a6ec

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3913054/
Cape
Cape
https://www.capesandbox.com/analysis/91282/

Comments