MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2
SHA3-384 hash: d9e4508b0ba03b32ad9f2fe9c8a4a3d5332471e5e6cd52611f9b3e83a7015eadd74e99fa2bce3e7741ccd0efff65e496
SHA1 hash: 5b2836e25c740fd47781a965a5a20f684b93d675
MD5 hash: 9a97e9f36c856d7660f1dedd940a7527
humanhash: grey-bravo-carolina-magnesium
File name:9a97e9f36c856d7660f1dedd940a7527
Download: download sample
Signature GCleaner
Create hunting rule
File size:314'368 bytes
First seen:2023-06-19 16:06:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 908fbf99c3f8c44c371239c262bab2c9 (2 x GCleaner, 2 x Smoke Loader)
ssdeep 6144:XNoiqOcq/PdQPkZEWFEnuAktCN+OKW0w6wErska8MqvmEZm:XNd5ca6kKZnHyC8OKW0w6TskvV
Threatray 197 similar samples on MalwareBazaar
TLSH T13064BF0372E3BC64D526DB728D6FC6F87B1EF9508E18279621286B1F09B02A3C573756
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2f1696969696922 (1 x GCleaner)
Reporter zbetcheckin
Tags:32 exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
308
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
9a97e9f36c856d7660f1dedd940a7527
Verdict:
Malicious activity
Analysis date:
2023-06-19 16:10:13 UTC
Tags:
gcleaner raccoon recordbreaker trojan loader stealer rat redline arkei vidar
Link:
https://app.any.run/tasks/75b44ca2-e639-4771-9ed1-3fa86a31d078

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Create hunting rule
Link:
https://www.capesandbox.com/analysis/400603/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.18082.10085.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
gcleaner greyware packed
Link:
https://www.filescan.io/uploads/64907d28dac8943115b20094/reports/6e0b4d90-fa71-4558-9b98-d178431a2f95/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1d7b830a-7d6c-44fc-84c7-33839eec4c70
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1257546
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Nymaim
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 890564 Sample: DrlpVd36ye.exe Startdate: 19/06/2023 Architecture: WINDOWS Score: 100 39 45.12.253.72 CMCSUS Germany 2->39 41 45.12.253.75 CMCSUS Germany 2->41 43 45.12.253.98 CMCSUS Germany 2->43 49 Snort IDS alert for network traffic 2->49 51 Multi AV Scanner detection for domain / URL 2->51 53 Found malware configuration 2->53 55 6 other signatures 2->55 8 DrlpVd36ye.exe 15 2->8         started        signatures3 process4 dnsIp5 45 45.12.253.56, 49714, 80 CMCSUS Germany 8->45 47 192.168.2.1 unknown unknown 8->47 57 Detected unpacking (changes PE section rights) 8->57 59 Detected unpacking (overwrites its own PE header) 8->59 12 WerFault.exe 9 8->12         started        15 WerFault.exe 9 8->15         started        17 WerFault.exe 9 8->17         started        19 7 other processes 8->19 signatures6 process7 file8 25 C:\ProgramData\Microsoft\...\Report.wer, Unicode 12->25 dropped 27 C:\ProgramData\Microsoft\...\Report.wer, Unicode 15->27 dropped 29 C:\ProgramData\Microsoft\...\Report.wer, Unicode 17->29 dropped 31 C:\ProgramData\Microsoft\...\Report.wer, Unicode 19->31 dropped 33 C:\ProgramData\Microsoft\...\Report.wer, Unicode 19->33 dropped 35 C:\ProgramData\Microsoft\...\Report.wer, Unicode 19->35 dropped 37 3 other malicious files 19->37 dropped 21 conhost.exe 19->21         started        23 taskkill.exe 19->23         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2023-06-19 12:43:48 UTC
File Type:
PE (Exe)
Extracted files:
34
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdngzzktgd2phduywon7a7hxl7nl3abjmqu7cu4mjdk56sm5jdja._file
Verdict:
malicious
Similar samples:
050de32f0e556f3958f28d94ab1434d8b2adc592c2517519c687ce3bc49cc72d
GCleaner
591a56e9b0178fa2b7479ae4e7553bd805e9e7591770f7ca420198bb1a43dc44
GCleaner
84851bf29e6671233a41773ca2d5fb24af1399cf62ca513e6f2cc9516cff69a2
GCleaner
94dfc73a4409e807d19d4df9e2f940299269ccb6935cd7886fd1f9bf87399e86
GCleaner
97cac9a5070b0a0d7cd694028a91b93eb82b62173d427cb87c4d21ceb293f81c
GCleaner
99bb5c62c5a6a8d22b3a2e8c15a6981764b24c847fbbe0b0e883d5e2aacaee6c
GCleaner
b6781b3e1a3ad14f1cc6d92deb6802fddac98d32dd6091c8789529b923091041
GCleaner
ce50470cdf4403722baafbeb9bb10d95fd954613b35e4a2e5bd6df59daff0817
GCleaner
e4a3880d21b1413d4b4537d40529477fbedf70c0d1f7d474b35624a068a70fa0
GCleaner
eee68fea64537a6db53809ce182873cf880ea71383bb46c6a3837cca1086cfa0
GCleaner
+ 187 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner loader
Link:
https://tria.ge/reports/230619-tkmg5sga7x/
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Deletes itself
GCleaner
Malware Config
C2 Extraction:
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Unpacked files
SH256 hash:
b98acf1c6f5edc3a6eb80f9d5cc07eb8e2cc0f25f6d63e5f79a1090876e2d588
MD5 hash:
31bd047f848d0efc202b7406960872fe
SHA1 hash:
13b3409430b62ce3fee441f7eca58d827df47005
Detections:
Nymaim
Create hunting rule
win_nymaim_g0
Create hunting rule
win_gcleaner_w0
Create hunting rule
win_gcleaner_auto
Create hunting rule
Link:
https://www.unpac.me/results/f7108cab-6333-4f80-83f5-f214af910bce/
Parent samples :
0c66455c62f9e8d2755760f97d5e51e26267682cc9a6ec15bae1f1d0bbeaaa65
60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2
f6cf800d44ff24fc1d1c06ccb0df605c5585f56fd041d335a5fe15628a1e9428
589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e
a75c766167a44c78f3824d28780078cf2cc31522a55372958cefd5f3f093e4c1
c6820216f0f3c79377dc2fbd0e82971910cccda00efa6de17fe0912076efacc3
dcba1aa4b4d92b68713b03f12985b0b0689055b3921e0273506d23f7e675ff52
e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa
ee366039716c1ca70c1c1744faaf2aeeae8d780c6bbd438cc0c1fef3f7a57cc7
SH256 hash:
60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2
MD5 hash:
9a97e9f36c856d7660f1dedd940a7527
SHA1 hash:
5b2836e25c740fd47781a965a5a20f684b93d675
Link:
https://www.unpac.me/results/f7108cab-6333-4f80-83f5-f214af910bce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_gcleaner_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.gcleaner.
Rule name:win_gcleaner_de41
Create hunting rule
Author:Johannes Bader
Description:detects GCleaner
Rule name:win_gcleaner_w0
Create hunting rule
Author:Johannes Bader @viql
Description:detects GCleaner

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 60da6ce55330f4f38e98b39bf07cf75fdabd80296429f1538c48d5df499d48d2

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2666413/
Cape
Cape
https://www.capesandbox.com/analysis/400603/

Comments


Avatar
zbet commented on 2023-06-19 16:06:56 UTC

url : hxxp://45.9.74.80/offer/setup.exe