MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 15


Intelligence 15 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
SHA3-384 hash: de5a4ad2b8212bb4a0b0e910a09ccf87974e72344592912eacafc0c2e4badca8f9643af79d27b6c2b9b8c117e30b4d2b
SHA1 hash: 67335447978bfa2e33b160a41e1a835799a8f576
MD5 hash: 2b2482d5830458bbee5d646810f5cdd4
humanhash: illinois-double-thirteen-orange
File name:Soft.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:3'577'632 bytes
First seen:2025-08-22 17:51:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 40c6fa0bae4a4073700c5b83b959e25e (5 x GCleaner, 1 x Amadey)
ssdeep 49152:2Vt81+4RVO7E8J0wLn40DLAwf+5YUJVdLRK92SSXs/f2gKiTv/fl:2Vt81vx8J0mn40DL/f+PJVdLvSysHigl
TLSH T165F5E02E56F214B5D54339F4CA5FAB645CF1B9A03C344C2491F92FCAAE99F02F4139A2
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter aachum
Tags:exe gcleaner


Avatar
iamaachum
https://download-trust.eu/kmspico/ => https://mega.nz/folder/j9hgzJCI#6wRvBCeNNI8eprJWtlsHxw

GCleaner C2: 176.46.158.23

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Soft.exe
Verdict:
Malicious activity
Analysis date:
2025-08-22 17:51:58 UTC
Tags:
gcleaner loader
Link:
https://app.any.run/tasks/9ae7a511-856d-4367-9de0-0ae864496e03

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23062/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a8ae32e9d9dbcfd96d2231
Tags:
delphi emotet cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Connection attempt to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi expired-cert fingerprint invalid-signature keylogger packed signed threat
Link:
https://www.filescan.io/uploads/68a8ae407137d68458384890/reports/658a399f-ae1e-4b35-87ec-af783acc31c4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-08-22T10:52:00Z UTC
Last seen:
2025-08-22T10:52:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d/results?tab=lookup
Malware family:
RealVNC
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d6a0402d-a813-4385-b8f6-709ab2baa720
Result
Threat name:
CryptOne, GCleaner, LummaC Stealer, Pure
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1763169
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Creates / moves files in alternative data streams (ADS)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files to the user root directory
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found strings related to Crypto-Mining
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries Google from non browser process on port 80
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Potentially Suspicious Child Process Of Regsvr32
Sigma detected: Powershell launch regsvr32
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected LummaC Stealer
Yara detected PureLog Stealer
Yara detected Socks5Systemz
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1763169 Sample: Soft.exe Startdate: 22/08/2025 Architecture: WINDOWS Score: 100 131 185.156.73.98 RELDAS-NETRU Russian Federation 2->131 133 45.91.200.135 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Netherlands 2->133 135 16 other IPs or domains 2->135 169 Suricata IDS alerts for network traffic 2->169 171 Found malware configuration 2->171 173 Malicious sample detected (through community Yara rule) 2->173 175 23 other signatures 2->175 14 Soft.exe 2 2->14         started        18 svchost.exe 2->18         started        20 regsvr32.exe 2->20         started        22 8 other processes 2->22 signatures3 process4 dnsIp5 123 C:\Users\user\AppData\...\svchost015.exe, PE32 14->123 dropped 125 C:\Users\user\AppData\Local\...\svc1BCD.tmp, PE32 14->125 dropped 191 Writes to foreign memory regions 14->191 193 Found hidden mapped module (file has been removed from disk) 14->193 25 svchost015.exe 31 14->25         started        195 Changes security center settings (notifications, updates, antivirus, firewall) 18->195 29 MpCmdRun.exe 18->29         started        197 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->197 153 127.0.0.1 unknown unknown 22->153 file6 signatures7 process8 dnsIp9 155 drive.usercontent.google.com 142.250.65.161, 443, 49685 GOOGLEUS United States 25->155 157 176.46.158.23, 49689, 49690, 49696 ESTPAKEE Iran (ISLAMIC Republic Of) 25->157 113 C:\Users\user\AppData\...\PbIE9NfYo86t.exe, PE32 25->113 dropped 115 C:\Users\user\AppData\...\e8p5xuHoH.exe, PE32 25->115 dropped 117 C:\Users\user\AppData\...\k9uY9MvBHj.exe, PE32 25->117 dropped 119 3 other malicious files 25->119 dropped 31 k9uY9MvBHj.exe 2 25->31         started        34 PbIE9NfYo86t.exe 25->34         started        36 e8p5xuHoH.exe 2 25->36         started        39 conhost.exe 29->39         started        file10 process11 file12 127 C:\Users\user\AppData\...\k9uY9MvBHj.tmp, PE32 31->127 dropped 41 k9uY9MvBHj.tmp 18 26 31->41         started        129 C:\Users\user\AppData\...\PbIE9NfYo86t.tmp, PE32 34->129 dropped 44 PbIE9NfYo86t.tmp 34->44         started        177 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 36->177 179 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 36->179 46 e8p5xuHoH.exe 36->46         started        signatures13 process14 dnsIp15 101 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 41->101 dropped 103 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 41->103 dropped 105 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 41->105 dropped 111 21 other malicious files 41->111 dropped 50 hddlifeconsole4529.exe 1 19 41->50         started        107 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 44->107 dropped 109 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 44->109 dropped 54 PbIE9NfYo86t.exe 44->54         started        165 tiltyufaz.ru 213.252.245.117 IST-ASLT Lithuania 46->165 199 Query firmware table information (likely to detect VMs) 46->199 201 Tries to harvest and steal browser information (history, passwords, etc) 46->201 203 Tries to steal Crypto Currency Wallets 46->203 205 Tries to steal from password manager 46->205 56 chrome.exe 46->56         started        58 chrome.exe 46->58         started        60 chrome.exe 46->60         started        62 chrome.exe 46->62         started        file16 signatures17 process18 dnsIp19 137 66.63.187.153 ASN-QUADRANET-GLOBALUS United States 50->137 139 62.210.200.68 OnlineSASFR France 50->139 95 C:\ProgramData\HDDLifeConsole\sqlite3.dll, PE32 50->95 dropped 97 C:\ProgramData\...\HDDLifeConsole.exe, PE32 50->97 dropped 99 C:\Users\user\AppData\...\PbIE9NfYo86t.tmp, PE32 54->99 dropped 64 PbIE9NfYo86t.tmp 54->64         started        141 192.168.2.9, 443, 49672, 49685 unknown unknown 56->141 68 chrome.exe 56->68         started        71 chrome.exe 58->71         started        file20 process21 dnsIp22 87 C:\Users\user\is-88CHS.tmp, PE32 64->87 dropped 89 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 64->89 dropped 91 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 64->91 dropped 93 C:\Users\user\3SeaGreen.dat (copy), PE32 64->93 dropped 167 Drops PE files to the user root directory 64->167 73 regsvr32.exe 64->73         started        143 www.google.com 142.250.64.68 GOOGLEUS United States 68->143 145 ogads-pa.clients6.google.com 142.251.40.138 GOOGLEUS United States 68->145 151 3 other IPs or domains 68->151 147 142.250.176.196 GOOGLEUS United States 71->147 149 142.250.81.234 GOOGLEUS United States 71->149 file23 signatures24 process25 dnsIp26 159 205.205.240.151.dnsbl.sorbs.net 73->159 161 205.205.240.151.bl.spamcop.net 73->161 163 15 other IPs or domains 73->163 121 C:\Users\user:.repos, data 73->121 dropped 181 System process connects to network (likely due to code injection or exploit) 73->181 183 Suspicious powershell command line found 73->183 185 Creates / moves files in alternative data streams (ADS) 73->185 187 Found strings related to Crypto-Mining 73->187 78 powershell.exe 73->78         started        81 powershell.exe 73->81         started        file27 signatures28 process29 signatures30 189 Loading BitLocker PowerShell Module 78->189 83 conhost.exe 78->83         started        85 conhost.exe 81->85         started        process31
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/2b2482d5830458bbee5d646810f5cdd4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d/
Threat name:
Win32.Trojan.Gcleaner
Create hunting rule
Status:
Malicious
First seen:
2025-08-22 17:52:43 UTC
File Type:
PE (Exe)
Extracted files:
48
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6z7xf2qy2g6so7ocbusqj7vmmddl3zz5uj2q3n2kk442hqcfagq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250822-wfgr7sbq2v/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3eeec0ec-5ac0-44c6-8465-41bd007e47dc
Unpacked files
SH256 hash:
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
MD5 hash:
2b2482d5830458bbee5d646810f5cdd4
SHA1 hash:
67335447978bfa2e33b160a41e1a835799a8f576
Link:
https://www.unpac.me/results/80882481-5ae6-4e59-9f09-4f3bd7b1588f/
SH256 hash:
5a5ed78e04c7ad144a4580c19e9743d252b4a25e84ba7e6c4c43fc459c956a9a
MD5 hash:
8aadb7e2a4e0128b357b6e90d924d128
SHA1 hash:
cfc4678d82f0e4b0cebd1fb0b01f479dc25134d5
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/80882481-5ae6-4e59-9f09-4f3bd7b1588f/
Parent samples :
2046f265e025776e7199a9e576be5ed49483841f5203c3e3eeb79d0a24f73920
384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
768f9ecc19a84b15234ead8058f24a9c8a337430312eab9ecbbcbfa8ab69d0f3
aba7585008a92523b09b28c94fdd8fb7afc39b5b466efac8ca5f7f2b520bbedd
ca4a5fcd9eff405f9f8037e89e1a72914eda7129e5aa9476283021c03c56500c
c5e135c050b4ecbc73acae15b6dbbfaf5157e60fe62c96913b4c56df77ae4feb
dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
c582323df2a900ae3b0b1860ff768aa5e90f3e595b33aecb57040b130a65e632
e65f22bbb7a32f6fd436eb0ea6de0c000542ffd6785a983d8f0594b791331994
70cc21383260ea0cb520627324853ae7665cb4b8f6462c5a96e07375a2c26317
3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
408ef63acd027f6ba843e30d00d51e506d714804ee842a83f4f31a4b5d7aa7d9
f62ad9ecb4facb02dead75e27e29db58519b6805f49278852d02298b55e59cf5
758e36455c17152210a6ae8001e3b9d7680159440e0e6ae702b9302ec2160d50
a91a863821ef21472adfeeed5e90eebf3fe5e559f257f7d37de401c2a0553485
8b2d9358a329089c3bd96cce97b91e9b8a4d900abd0aaa8e55c3c0466e930c88
9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3
e41b1aa6ff791b7611638851db2ba42c47a125a81b5c74d10354f4f87d4e8770
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
05664da4d3ea8b39b6183a1112e67f46a8715536faa0a9469bc2659f4ef16289
d3a77d8bcd9963d30fd3e51acee6654e3ccbf2b2b81fbe47e97b9b9068c76f06
1a757566caa5edd32fd5c190b9e8da7d7abf3398b9a3ceddd365a95886434767
53afe13ca6d157bec8b1cc467764abd1194fb3bbd06c0a67a2ee5f560b63d1a4
82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
512b629f01ce1668bcc60ea305e93fb264cf2b7f2f87bb3aafef29beeb604cce
cc261502042db67adb917ce03321ee47277cfbc1712b770c6b71c035b89793cb
477df2a52197bd71524c4ccf192ce2d2afb8b4b3d8e33f8efa418910342f30e7
a53952ad1b88e5d6b4fc14f09e4ccd0f2ce4be72df7c5693abd8cdad953a4871
5dfcdc1c491fbf2f7f2fbac6bbf27b84be652583b66b252c46e8ed86577c3c60
SH256 hash:
0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c
MD5 hash:
4ce3ce196eda86d92b68362b6269b618
SHA1 hash:
fd42ee0aca0315acac25c297f1ce33634c549559
Link:
https://www.unpac.me/results/80882481-5ae6-4e59-9f09-4f3bd7b1588f/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4fb3fb9750c6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d

(this sample)

  
Link
https://tria.ge/250822-was82sxmy2/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/23062/

Comments