MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e22df8d17b464398165345d435aeab78011cfabf309e5d8339472fe8d1a2971. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e22df8d17b464398165345d435aeab78011cfabf309e5d8339472fe8d1a2971
SHA3-384 hash: f69928adfc3db3f6955a846afe133187df34f3659b2484e89d4e457911d4ea03269699abcf42b3656db4536d47db8458
SHA1 hash: dc4aafd76dfdafc5224e9eb986df987cfe828a74
MD5 hash: 8a362d36a141c11044d0e02e498f27be
humanhash: saturn-sixteen-delta-two
File name:file
Download: download sample
Signature GCleaner
Create hunting rule
File size:415'232 bytes
First seen:2022-10-10 18:44:05 UTC
Last seen:2022-10-10 19:28:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ae11519a6eac288b6a17a0c03e5a652c (10 x Smoke Loader, 2 x GCleaner, 1 x DanaBot)
ssdeep 6144:jZens/wTPToCzw867VtPk05vhIJ2kKRM0bLWxb2JgrwVfquS:jaTPJq205vhi27Rqp1d
Threatray 1'392 similar samples on MalwareBazaar
TLSH T1BF94F130B952DC71C80931308463DFA42BBEED6554648A437BB83B6D6E733816A7639F
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 33f0e8e8e8e46869 (1 x GCleaner)
Reporter andretavare5
Tags:exe gcleaner


Avatar
andretavare5
Sample downloaded from http://95.214.24.96/load.php?pub=mixinte

Intelligence

File Origin
# of uploads :
18
# of downloads :
317
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318618/
Detection(s):
Win.Malware.Azorult-9949206-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Creating a file in the system32 subdirectories
Creating a file
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42338/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CPUID_Instruction
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6344682fb3725d3f9a1b1602/reports/098ae3bc-a29f-47cc-a919-1166107b6b56/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/501c6a85-5336-4b8d-a572-6cdda9f350bf
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1087153
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e22df8d17b464398165345d435aeab78011cfabf309e5d8339472fe8d1a2971/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-10 18:45:08 UTC
File Type:
PE (Exe)
Extracted files:
50
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jyrn7dixwrsdtalfgrougwxkw6abdt5l6me6lwbtsrzp5di2ffyq._file
Verdict:
malicious
Similar samples:
054ec4ca2ccc08dcd5cd7412cf3d556f68a26e7cbb7ecfddeb097740187c3799
GCleaner
3c2902102c28b16db206cc577d87a8828a1f2e583362f74ef870ff7ed2a50f31
GCleaner
4e847643568276229dbc26f82152bbbbd2c5bf86b6bbd43080e297285c545b8c
GCleaner
8ec72faef5f0fcd1c8b3c5371eb3f9bd8beeefa034f7fc4750168df49e35a69f
GCleaner
9c6e7d1cc84f620c9f9d01c11bb7bdc1e7b8412b7698aed8b836cc386e089031
GCleaner
+ 1'382 additional samples on MalwareBazaar
Result
Malware family:
nymaim
Create hunting rule
Score:
  10/10
Tags:
family:nymaim trojan
Link:
https://tria.ge/reports/221010-xd2j9scge7/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Program crash
NyMaim
Malware Config
C2 Extraction:
208.67.104.97
85.31.46.167
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4e22df8d17b464398165345d435aeab78011cfabf309e5d8339472fe8d1a2971

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:win_gcleaner_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.gcleaner.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/318618/
  
URLhaus
https://urlhaus.abuse.ch/url/2276314/

Comments