MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6
SHA3-384 hash: a45b668de9c1f3fa7437f063807bf0096bbc1dbe46d60c542e62aa0aa40ea3d6da1e0f7c476b2697dc71c4fd1658ee79
SHA1 hash: 019e4208f200b01135d3bd8baa50c329d7ea384f
MD5 hash: 6f8fe30e702406d41db85f98fdda694b
humanhash: zulu-nine-ceiling-ten
File name:random.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:4'028'176 bytes
First seen:2025-11-08 07:54:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c2ffaac75292c9510a72a45eee801fb3 (3 x GCleaner)
ssdeep 49152:J3UnBYBTgQ804/GAjmWeBcBBUhDhAh33QwruX52ZQ8JRgR6lMgwRCXmaalSvMrU:JkwUQDxAjmWB4Dhw3AwyJMto9lTU
Threatray 227 similar samples on MalwareBazaar
TLSH T14216E00BCFB10A0AD11F1979C9E309591006BB49D48AFA5E3FACD83D56760F772BE11A
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6.bin.exe
Verdict:
Malicious activity
Analysis date:
2025-11-07 07:12:01 UTC
Tags:
delphi auto generic gcleaner loader lumma stealer autoit inno installer rhadamanthys websocket
Link:
https://app.any.run/tasks/3192b0d8-0b2e-4ae1-9162-46da3eb91dfb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/36496/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690ef76a3afb53888cc9a144
Tags:
delphi cobalt emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-08T10:38:00Z UTC
Last seen:
2025-11-08T13:27:00Z UTC
Hits:
~10
Detections:
UDS:DangerousObject.Multi.Generic HEUR:Trojan.Win32.Agent.gen
Link:
https://opentip.kaspersky.com/73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/86f0f17a-7744-44fa-8802-14673c2465bd
Result
Threat name:
CryptOne, GCleaner
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1810419
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected GCleaner
Behaviour
Behavior Graph:
Download SVG
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6/
Verdict:
Malicious
Threat:
Family.GCLEANER
Link:
https://tip.neiki.dev/file/73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2025-11-07 07:12:03 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=omuh4f5ebjsqnfcs55eckg2prphwqymirgeyh2mm3pcvkiii4lla._file
Verdict:
malicious
Label(s):
gcleaner
Create hunting rule
Similar samples:
06221cd497b1fd91c8f29e2e0c6ea5d69ae1b53c9402983f8b91d4b1684d9aaf
GCleaner
1ba2dece7e8dd30f7719af81ab01c9666ce37d0236c90bde92c98d84060c4024
GCleaner
41efb861dbd52669d69c3fd0ae3cabbf7c993601ff3e88649810487b3e5b997b
GCleaner
5b36eb63f4519ec3b39981b1e9b5ad10be9ecba8a09b86e87ab41a9a701b9511
GCleaner
82aae2701dfeda4d01c03ab9129702b9a6298302b76931ccc784c219d2acca31
GCleaner
85023ef1c4861562b41d07ead0b1bd139fb5ddd2621c83558392e8797fd031f5
GCleaner
a071db1acb51e629aeb194a9a960116581c3cef7be5dd7af11d55a291fe90357
GCleaner
d270e151fdcfab55ddbba8198881aaac6bd9f44a3113b8b2cb2ed64581720296
GCleaner
error
GCleaner
fb94e060b3129d360e4286a75d04dc396d3ffff274df3491ce429b05d7d24530
GCleaner
+ 217 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner discovery loader
Link:
https://tria.ge/reports/251108-jr9adawkfq/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
GCleaner
Gcleaner family
Malware Config
C2 Extraction:
185.156.73.98
45.91.200.135
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c1951cbb-0ad4-410a-a430-e93715dae108
Unpacked files
SH256 hash:
73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6
MD5 hash:
6f8fe30e702406d41db85f98fdda694b
SHA1 hash:
019e4208f200b01135d3bd8baa50c329d7ea384f
Link:
https://www.unpac.me/results/667bb9cb-8da1-46e4-a493-2dfb510edb97/
SH256 hash:
d3d3224b50e7ff955cba76e05f5058471add627c6f15658420146040192b3e1b
MD5 hash:
61f30fea94c55ee3199526448a73e58f
SHA1 hash:
71c175173df87bda7ffc77b2208b28f04bbdc628
Link:
https://www.unpac.me/results/667bb9cb-8da1-46e4-a493-2dfb510edb97/
SH256 hash:
122e9cebf4658d6eefff67ce813d1748c07e3dc20cef68b2be5f02d116fe974e
MD5 hash:
c85448e9e2fa4ee81cd2b9a512e5d6a8
SHA1 hash:
b00b3285a168f1a2514f348771b74eede88f187a
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/667bb9cb-8da1-46e4-a493-2dfb510edb97/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/73287e17a40a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/36496/
  
URLhaus
https://urlhaus.abuse.ch/url/3617799/
  
Delivery method
Distributed via web download

Comments