MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4fe1cb64f16f7fa987407a906a4319520972f5a8f5749e3b071a831825559a45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GCleaner
Vendor detections: 13
| SHA256 hash: | 4fe1cb64f16f7fa987407a906a4319520972f5a8f5749e3b071a831825559a45 |
|---|---|
| SHA3-384 hash: | 64a37117b7cba9dee4ae331f75277bc1560961ae0f6c1617151037ae292ab46e02b151586a76b9fb34976836731e5590 |
| SHA1 hash: | 1c556d68023668f7e399cb67a211672622fb4bea |
| MD5 hash: | a224fb7e0e9febf8604d6bb34e1f3669 |
| humanhash: | floor-freddie-alanine-cold |
| File name: | a224fb7e0e9febf8604d6bb34e1f3669.exe |
| Download: | download sample |
| Signature | GCleaner |
| File size: | 7'504'701 bytes |
| First seen: | 2021-12-21 01:30:41 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox) |
| ssdeep | 196608:JzWzZroqImNnZXwoUD59SerxLftVF2JGNMfGzaLEjBxS4QzwFX:JzWzZkWVZgrrVqaM47FX |
| Threatray | 1'691 similar samples on MalwareBazaar |
| TLSH | T1377633222253DE9FE8AB4BBD47D33951EB198EDC28B0D12FE0912E1474539B381F2567 |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe gcleaner |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 45.9.20.229:11452 | https://threatfox.abuse.ch/ioc/277936/ |
| 185.7.214.8:28299 | https://threatfox.abuse.ch/ioc/279255/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a224fb7e0e9febf8604d6bb34e1f3669.exe
Verdict:
No threats detected
Analysis date:
2021-12-21 06:13:05 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Launching a process
Using the Windows Management Instrumentation requests
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
barys chrome
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
RedLine SmokeLoader Socelars Vidar
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Sample uses process hollowing technique
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Socelars
Yara detected Vidar
Yara detected Vidar stealer
Yara detected WebBrowserPassView password recovery tool
Yara Genericmalware
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Mokes
Status:
Malicious
First seen:
2021-12-19 03:26:35 UTC
File Type:
PE (Exe)
Extracted files:
293
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
ryuk
Similar samples:
+ 1'681 additional samples on MalwareBazaar
Result
Malware family:
vidar
Score:
10/10
Tags:
family:redline family:smokeloader family:socelars family:vidar botnet:915 botnet:media18n botnet:v3user1 aspackv2 backdoor infostealer spyware stealer trojan
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
NirSoft WebBrowserPassView
Nirsoft
Vidar Stealer
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
Vidar
Malware Config
C2 Extraction:
http://www.biohazardgraphics.com/
https://noc.social/@sergeev46
https://c.im/@sergeev47
65.108.69.168:13293
159.69.246.184:13127
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://noc.social/@sergeev46
https://c.im/@sergeev47
65.108.69.168:13293
159.69.246.184:13127
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Unpacked files
SH256 hash:
e145af35ca7fcc9da24f8d0bd4f8cc9993ddf532a3d43bdf995f1528f58d5b7e
MD5 hash:
f785f4a83149814d32c597487d357f60
SHA1 hash:
e775adb0c6ab03167ee7bccb8890c60232f905f4
SH256 hash:
cf1ed8957d4825743d39f19529138de7131ca8f506440ddc1774f4640dffc599
MD5 hash:
ded1c6e8c89148495fc19734e47b664d
SHA1 hash:
3a444aeacd154f8d66bca8a98615765c25eb3d41
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
SH256 hash:
012c3d22b5374c4f595fcf1986bf2a67697f322f36e8bb6456809334f98f5781
MD5 hash:
8bacb64db8fb73308faefd14b863fd43
SHA1 hash:
c5bf54f8b9cc198d6d380f3ee7a74df2feadf32a
SH256 hash:
9dac78cf97a753e813b02cb654f076cdea03155bc9a98ed64ec248729ead52ec
MD5 hash:
29fa5c5ade39d4ae5a0f564949278923
SHA1 hash:
376051004220051779d97fcb44065a8724de370b
SH256 hash:
a6fe15069a6ea98b42471503e427375cdf14b92fd6bf6f69a21dbe2e1a675c98
MD5 hash:
26f0fa618a849f4c2c8a054bb41583d2
SHA1 hash:
2d34f74fafe0c0042e567858ed8a8601ce250d14
SH256 hash:
e7b8877389f0bfb5fb95f08a799a0e7d06a2f7161a0287552ff3eadf06bd1dd1
MD5 hash:
e9eb471509abbfb4456285e82b25d1c9
SHA1 hash:
b96ef576c147ea8a1b3e0bd5430117ba9ad31096
SH256 hash:
db6b15c045a92b5a72790276d211d52bef6d760ab63df97968561c02d81e72cb
MD5 hash:
3b3e06e2c8688b917dab4ab579e77e3a
SHA1 hash:
fb35053833bc3fa6f51dc46e1537434220c0b56f
SH256 hash:
22cef0b4c1b15fb2969d17d3667acc338e7a5f85ef898d27ab27e885b6361abc
MD5 hash:
e4461a5cf1bc02f48578bb419b459867
SHA1 hash:
f0b2cb7f9fe44d7498b273d37f8f4352ebb67175
SH256 hash:
ed1d717d35a927a8464dc954904af8bea56bcff628005c867b950a8010d99f87
MD5 hash:
554ff5f0936b8762b0c06ef07a84baeb
SHA1 hash:
b70d2d8d728894523d4b93e9b7fd178ce82530ae
SH256 hash:
fb5e44afa9b86e8d68f158b58036682dc28b8e3ed0d5391ffcd246f5bd8dec99
MD5 hash:
4c120576caedf379e15621df6328dfc0
SHA1 hash:
af3ddbcb753c2609d1b1c0985984a0957d9d0d0f
SH256 hash:
faea24ba9c90c23959e226b7935637c952979f7a7bf698b824d73ece6ec6087a
MD5 hash:
21b2276cfbd60b9ceed591421b3e9fcb
SHA1 hash:
a739ca7c244eb5fdcfdb8d1f9c50e6e6931022cb
SH256 hash:
2c82334549903d945a987d06142feb9a587f0cde25e715f37f58657e6a9aa41f
MD5 hash:
e6590ded1f460b3f2e3b433770c3c611
SHA1 hash:
a28cd02a0f612ed6e598e12790f025a143e56c2e
SH256 hash:
32dcadadc7f036cc709d8b4d117f3f44ffc163636ca380da906a7e76ab17bb5f
MD5 hash:
eb2188b318f03c3719c30f8f5377cdb2
SHA1 hash:
96de830de22155376ad2a98d669d5a9bd2e1b489
SH256 hash:
815a3b4e2d8afe608356aaa2091ad9e9e04d9a3ffb697cd8d29c4b8aaee6a220
MD5 hash:
26d3d8d713661a927683eaefb97c1aca
SHA1 hash:
95f2d3f3351cb351f600a8abc2a3336ce03d086a
SH256 hash:
1c10262bb225a9ec349e338cc8b6ff8148e08c68dd93708fc202021b972f907d
MD5 hash:
eaffdac15faecef56d2e2323075f7295
SHA1 hash:
77b01357a182a0f44baa4e79a3eb86a5f8672494
SH256 hash:
dcc1725b855ec8f21f1a78a72bc3951682a20709b129d16051cbbbfca2361c2a
MD5 hash:
851857aa313098b41716720126d1e9e1
SHA1 hash:
748d3a025f04a0526678af71a341097570c88e7e
SH256 hash:
df6c92eb4d6386d32add969a151b3b663506eb6d1237cbdd0fa629effc90ce71
MD5 hash:
60acab16d03cd8359fe0e909046e57aa
SHA1 hash:
67424395518272263589ecc82db7b7f9203e4891
SH256 hash:
856e94ad9766bf8cb5112494f0bd4cb7062e6f19924edea0b74d79f24c5d3eca
MD5 hash:
8f7bea188e44c62581d12759841aef5c
SHA1 hash:
536141097b74755825a8c87e058c8fa46434eca7
SH256 hash:
5710a73239e215082b0a4703974169982e59924ee8a94d4d3e0294a1ff1090c0
MD5 hash:
c2465e4c9eb5c020d9ceae2f58f7f784
SHA1 hash:
2ba0a6be70392a807f1ccb952d3de5ddd8e7cecb
SH256 hash:
0d77704ecaf15bc28b240c62adb8ac2f4f6a492e884b5b15e31d529def84d70c
MD5 hash:
0b0eac19f095740b1464f0826b17bb08
SHA1 hash:
1b6e827b4a23ac26b11ae497c6d18fc6e23070b8
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
SH256 hash:
fdfcbc8cfb57a3451a3d148e50794772d477ed6cc434acc779f1f0dd63e93f4b
MD5 hash:
a6865d7dffcc927d975be63b76147e20
SHA1 hash:
28e7edab84163cc2d0c864820bef89bae6f56bf8
SH256 hash:
104788bc7a2a7770a13bfd78e2ada498005de1f99278a1fa4e45696506f72442
MD5 hash:
d0bc61a954e6c51f7ddc889138431965
SHA1 hash:
cedda285fb87653fdba2637d91d6b53aaa1d3e85
SH256 hash:
05c434523be519af10130da9389066e1dba2ec7d8517ecb6396972bb6313dd56
MD5 hash:
32e6f6be8aaa5b338b8bb53956d2fd88
SHA1 hash:
e8798f0f4e56a4b6c215973565465aea5ff1710f
SH256 hash:
54031d60fa482bd1e55bf8edb57ca281b7ca37b1434c66b3b0c0910ae9a6851c
MD5 hash:
69423d4b2a24fb6261e40406e0d34a36
SHA1 hash:
be7de7b7d6260ce3cd1cdcf63e074b9d589988e7
SH256 hash:
a2567b0c0f2e18d8fcca8dd7ae79b931745ff063146a534bba3543d9d67b11ed
MD5 hash:
3c3885797e4b8ad3af8fadb1ee332fd3
SHA1 hash:
029bb5c32dc186342f93ad7149f395f1fe25255b
SH256 hash:
7b177d8e968b39fd03d0985ec6ff2242ea85f2d6530392c9fd28eadc69179c08
MD5 hash:
f4cf8d0114f4fa867410d1f512de9abb
SHA1 hash:
95eea0acce098fa7c8fbd3f9a110d89109af9ee2
SH256 hash:
fca1173bf6ea2e174bd15f68fded22c8fc55abcc7ddddbc82c62a575cc14a35e
MD5 hash:
9f8d544dd1b6bb185fb7b46c73da4c9e
SHA1 hash:
0c079993ccf6fa83af27b1772b7424db3fdded14
SH256 hash:
e0ed406865b429f538f893d061948b4a1f7139d0439c05cd423f6fb30a494e38
MD5 hash:
2d957736db34cb96a744ede8345e2a63
SHA1 hash:
2ef58d0a6f8e1343bbddcb5a53f47653ab7ea9d6
SH256 hash:
397a764a0869d6acc4a3256b5a2bc20d63b004ecae468b677c37bf0e0f0ec4fd
MD5 hash:
3af39256a07fb2364fec19d737533335
SHA1 hash:
768f0bf0409e409bae9d646e89423deea0ab575f
SH256 hash:
4fe1cb64f16f7fa987407a906a4319520972f5a8f5749e3b071a831825559a45
MD5 hash:
a224fb7e0e9febf8604d6bb34e1f3669
SHA1 hash:
1c556d68023668f7e399cb67a211672622fb4bea
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.