MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 53732848b0ab1a1c97a4df5c9714d94f2a267b22958a8db2b0d9cef82f3a0095. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GCleaner
Vendor detections: 14
| SHA256 hash: | 53732848b0ab1a1c97a4df5c9714d94f2a267b22958a8db2b0d9cef82f3a0095 |
|---|---|
| SHA3-384 hash: | f0a39e0713445638572e6f18b5c726381b2680ea10953f1c56d984e3bdedc32c250838612fd96bf0e5d6279e1e52b8df |
| SHA1 hash: | 93b35ae57e91747fe74a7ed2d4d6c0e0ace1c6e7 |
| MD5 hash: | 100f695deb6ab8a5221711409ec1d575 |
| humanhash: | high-orange-lake-three |
| File name: | file |
| Download: | download sample |
| Signature | GCleaner |
| File size: | 2'825'893 bytes |
| First seen: | 2022-11-09 01:01:57 UTC |
| Last seen: | 2022-11-09 01:13:59 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'494 x Socks5Systemz, 262 x RaccoonStealer) |
| ssdeep | 49152:Z2Fja+GjVi9FAS4vcwSzIRUmm6LH8/F0V19mw1UCTjufLBNA5hq:MFjZSSFASMSWUmZT8/F0jQw1FgLBeDq |
| Threatray | 3'254 similar samples on MalwareBazaar |
| TLSH | T199D5335A0241967BE014E4B45D6EDE7ACBB43AB72469F06036ED0E8C9A2F25DCC7C371 |
| TrID | 50.3% (.EXE) Win32 Executable PowerBASIC/Win 9.x (148303/79/28) 37.2% (.EXE) Inno Setup installer (109740/4/30) 4.8% (.EXE) Win32 Executable Delphi generic (14182/79/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter |  andretavare5 |
| Tags: | exe gcleaner |
Intelligence
File Origin
# of uploads :
8
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-09 01:06:59 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Modifying a system file
Searching for synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Nymaim
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Yara detected Nymaim
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Privateloader
Status:
Malicious
First seen:
2022-11-09 01:02:11 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
17 of 26 (65.38%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 3'244 additional samples on MalwareBazaar
Result
Malware family:
nymaim
Score:
10/10
Tags:
family:nymaim discovery trojan
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Loads dropped DLL
Executes dropped EXE
NyMaim
Malware Config
C2 Extraction:
45.139.105.171
85.31.46.167
85.31.46.167
Unpacked files
SH256 hash:
b26ce6f08ca544195032a843ad438e69322da08f7261b8657dc0b868687b0830
MD5 hash:
8a7116843a67c7ae8e59704989e613b3
SHA1 hash:
676074027e282e53bae5b8dea9deeab7d8170b78
Detections:
win_nymaim_g0
Nymaim
win_gcleaner_auto
SH256 hash:
96f15077cea786ab572cb74a3388cfb816d0e05a3f186e3cbf805f6380da983f
MD5 hash:
4f6b35021aacb22cb0ed21075ebec46a
SHA1 hash:
c3bddecd00543f8217f35923d150ac13ac5e0fb9
SH256 hash:
b5bf8ac1406d5c70772531561b618d9e679389d935f4dbf43e0164ab325813bb
MD5 hash:
828a09b69b78450f0e85642392b161bd
SHA1 hash:
38ee7676a05eae8fc5921e9ec7b753c966f3c0fb
SH256 hash:
53732848b0ab1a1c97a4df5c9714d94f2a267b22958a8db2b0d9cef82f3a0095
MD5 hash:
100f695deb6ab8a5221711409ec1d575
SHA1 hash:
93b35ae57e91747fe74a7ed2d4d6c0e0ace1c6e7
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Dropped by
PrivateLoader
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.