MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47159757c0e58254d6b59eab72adc87b58dca31897a53cf0cace18e06863a0b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47159757c0e58254d6b59eab72adc87b58dca31897a53cf0cace18e06863a0b3
SHA3-384 hash: d2198d848282d2d1ce82b7baa49560760a0ab4e515ce1f6e2a56d779c45b763c3c89749e6ac2db1add7221e4aab9e6e8
SHA1 hash: 5d477a982c26b5091d0f143f54a8e599ed040958
MD5 hash: b6c47995a6103f9b860f909dd4c01fe5
humanhash: idaho-edward-september-two
File name:b6c47995a6103f9b860f909dd4c01fe5.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:403'968 bytes
First seen:2022-05-29 13:06:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash face88db180055f7b959d0d8ad853754 (4 x Smoke Loader, 1 x GCleaner)
ssdeep 6144:uEF21u2TT40e4e80Lr8mo3RQEpA0j1k0V+Ug5VeggqqeYP5bI0l9o:lF2jTDT70LwmoFAoG0VrKcrqsG0l
TLSH T19D84BF107F90D434F5BB11F48576C368753ABEA16B2095CB63E42AEE5A386D0EC3139B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 93f0e8e8ececf893 (2 x GCleaner)
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
349
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b6c47995a6103f9b860f909dd4c01fe5.exe
Verdict:
Malicious activity
Analysis date:
2022-05-29 13:07:44 UTC
Tags:
loader evasion
Link:
https://app.any.run/tasks/ddd63d13-0e62-40a5-81af-6bcd21434929

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Create hunting rule
Link:
https://www.capesandbox.com/analysis/275243/
Detection(s):
Win.Ransomware.Stopcrypt-9950704-0
Create hunting rule

Win.Ransomware.Stopcrypt-9950820-0
Create hunting rule

Win.Packed.Stopcrypt-9950836-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending an HTTP GET request
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Launching a tool to kill processes
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/20415/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed ransomware
Link:
https://www.filescan.io/uploads/6293700f6eb3ff32633c1711/reports/09605253-222d-4d0e-aeef-7c2c3d77fce8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1e1aff07-97c0-450b-9226-345e218f0a9c
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1003250
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Nymaim
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 635742 Sample: 4EaNtXwQvh.exe Startdate: 29/05/2022 Architecture: WINDOWS Score: 60 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected Nymaim 2->41 43 Machine Learning detection for sample 2->43 7 4EaNtXwQvh.exe 14 2->7         started        process3 dnsIp4 37 37.0.8.39, 49777, 80 WKD-ASIE Netherlands 7->37 10 WerFault.exe 9 7->10         started        13 WerFault.exe 9 7->13         started        15 WerFault.exe 9 7->15         started        17 7 other processes 7->17 process5 file6 23 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 10->23 dropped 25 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 13->25 dropped 27 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 15->27 dropped 29 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 17->29 dropped 31 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 17->31 dropped 33 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 17->33 dropped 35 3 other malicious files 17->35 dropped 19 conhost.exe 17->19         started        21 taskkill.exe 17->21         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47159757c0e58254d6b59eab72adc87b58dca31897a53cf0cace18e06863a0b3/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-05-28 22:46:59 UTC
File Type:
PE (Exe)
Extracted files:
32
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220529-qcmldsdfd6/
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Deletes itself
Unpacked files
SH256 hash:
a0b348ae08664e5ccc0f3596020aecc5cc779c56b1db07f726a163a152cd9457
MD5 hash:
0eea16edb874efb6cbbf2d1dc71c6480
SHA1 hash:
c948bd3f07e1785a160d272c533d2d11fe79cf7c
Link:
https://www.unpac.me/results/6ba036d8-97f8-4ccc-9708-778869f8c72d/
Parent samples :
b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34
45f64ad405eaa4ed35eb74b4e773cb1041c377abdc2b80599168018a2e1406bc
4eecbfc54480c8b8e98d3abba71b70d63575355141f4892a55d49631841ebfba
190a63203f7970e14c4f9f886ad814bbb5b30160dcba66d22b78583baaae478e
d97409bc67beeca578cfa94b5058501dd8951e4206a18a019702e039966a22dc
81a110de18613503c0f3075da56cdbe363091cebcd8c52423ac1d63aa791bb22
cd8fdfee914d46d345bedd2868f2aec93c48fd00385492e377793f06cd42dc1f
6763b0b45f0fd8e32e29377a207058fc42a02bb6d1db368c76fd0af470abc341
5ec64b926c9e2f1d2c69f92b69b5c9169b23d533f327ac944776e8e266eaab99
SH256 hash:
47159757c0e58254d6b59eab72adc87b58dca31897a53cf0cace18e06863a0b3
MD5 hash:
b6c47995a6103f9b860f909dd4c01fe5
SHA1 hash:
5d477a982c26b5091d0f143f54a8e599ed040958
Link:
https://www.unpac.me/results/6ba036d8-97f8-4ccc-9708-778869f8c72d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47159757c0e58254d6b59eab72adc87b58dca31897a53cf0cace18e06863a0b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 47159757c0e58254d6b59eab72adc87b58dca31897a53cf0cace18e06863a0b3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2212368/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/275243/

Comments