MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 800175a19a10dae3a8acbbfec1291416b5babb144cbedd017c5a75c816687381. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GCleaner
Vendor detections: 12
| SHA256 hash: | 800175a19a10dae3a8acbbfec1291416b5babb144cbedd017c5a75c816687381 |
|---|---|
| SHA3-384 hash: | 76594466bbef6e4dff7d3a983c53c61280bb5a395755977d5c5a6cb4899c292bec9096e76d1b7c3b4add791393fb0629 |
| SHA1 hash: | a9bfb137114e9ba56d7a36ae3cc2ab1aa54f742a |
| MD5 hash: | b1eb7d97d87b9e894a83a23f033777aa |
| humanhash: | undress-papa-missouri-blossom |
| File name: | b1eb7d97d87b9e894a83a23f033777aa.exe |
| Download: | download sample |
| Signature | GCleaner |
| File size: | 9'834'907 bytes |
| First seen: | 2022-01-24 12:02:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer) |
| ssdeep | 196608:xvLUCgUsUObQdjX2n0UQ8kkGdapIpgGMkBdL0KKy2xSaGKno:xzdgj2rY0UQ1kGdapgtNBAxJg |
| Threatray | 410 similar samples on MalwareBazaar |
| TLSH | T1B4A6336638D1B8F5E99218BA88ACFBF611F60358DF3106FBB750D9A6DF7A018810D54C |
| File icon (PE): |  |
| dhash icon | 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox) |
| Reporter |  abuse_ch |
| Tags: | exe gcleaner |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://appwebstat.biz/stats/done.php | https://threatfox.abuse.ch/ioc/316211/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DLInjector03
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Searching for the window
Running batch commands
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Launching a process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
arkeistealer barys overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Verdict:
Malicious
Result
Threat name:
Raccoon RedLine SmokeLoader Socelars Vid
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Sample uses process hollowing technique
Sigma detected: Accessing WinAPI in PowerShell. Code Injection.
Sigma detected: Powershell Defender Exclusion
Sigma detected: Shell32 DLL Execution in Suspicious Directory
Sigma detected: Suspicious Remote Thread Created
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to evade analysis by execution special instruction which cause usermode exception
Yara detected onlyLogger
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Socelars
Yara detected Vidar stealer
Yara detected WebBrowserPassView password recovery tool
Yara Genericmalware
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Zapchast
Status:
Malicious
First seen:
2022-01-19 11:52:12 UTC
File Type:
PE (Exe)
Extracted files:
700
AV detection:
29 of 43 (67.44%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
ryuk
Similar samples:
+ 400 additional samples on MalwareBazaar
Result
Malware family:
vidar
Score:
10/10
Tags:
family:onlylogger family:raccoon family:redline family:socelars family:vidar botnet:8fc55a7ea41b0c5db2ca3c881e20966100c28a40 botnet:915 botnet:media23nps botnet:v3user1 aspackv2 evasion infostealer loader persistence spyware stealer trojan
Behaviour
Kills process with taskkill
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
NirSoft WebBrowserPassView
Nirsoft
OnlyLogger Payload
Vidar Stealer
OnlyLogger
Process spawned unexpected child process
Raccoon
RedLine
RedLine Payload
Socelars
Socelars Payload
Vidar
Malware Config
C2 Extraction:
http://www.biohazardgraphics.com/
65.108.69.168:13293
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
159.69.246.184:13127
65.108.69.168:13293
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
159.69.246.184:13127
Unpacked files
SH256 hash:
3838a3056d2ffcadce93fc3308e8b05ab1a9ba80d62ab1e5795b3a93059ddda3
MD5 hash:
eef5aa795b8c7bd8cde26f28ae865417
SHA1 hash:
c3f7e948d95d11295cd1e6d6827664df6bea2fef
SH256 hash:
e7b8877389f0bfb5fb95f08a799a0e7d06a2f7161a0287552ff3eadf06bd1dd1
MD5 hash:
e9eb471509abbfb4456285e82b25d1c9
SHA1 hash:
b96ef576c147ea8a1b3e0bd5430117ba9ad31096
SH256 hash:
cf1ed8957d4825743d39f19529138de7131ca8f506440ddc1774f4640dffc599
MD5 hash:
ded1c6e8c89148495fc19734e47b664d
SHA1 hash:
3a444aeacd154f8d66bca8a98615765c25eb3d41
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
SH256 hash:
ee2cc85a8e1972a29ce67ab0218d5daa8fc9b67f36111c71eccaf6da05219d19
MD5 hash:
f6271f82a952f96ba9271a4a27c9f22f
SHA1 hash:
d12708b9e39a0cd06add96316b65f1668d6a1246
SH256 hash:
857b588fd6e424e6e8a37ac9accb41389fc74981ed88d72c78f35eec6002927b
MD5 hash:
6971172bea30fe1f0d20a8e2bcc63ad1
SHA1 hash:
c5f59cefc88b6604d76f0ee5baef221d8477f3c2
SH256 hash:
d5e269e5cf8557928533ba7ed3e9f3baedb4fdac5f25bc648b631db986a35050
MD5 hash:
be6972d370fb1e496f799e52d8ad78d0
SHA1 hash:
aa49cbd7e0f9f48515c92689450fafbe8d0283a9
SH256 hash:
bdaed9486223e2becc934935671ea8e85a3c073f321d8890066b62e363aadab6
MD5 hash:
a7f979fbdd6a11090cec150dc311c0e4
SHA1 hash:
a825cec4b91a32b42ec1790da2f68af2c1508561
SH256 hash:
342d74e640463918a1c4e70c98449bbd4e4436b4c0531f0374c77c2c7b345f4c
MD5 hash:
f449bbdb97f6a8d31d1b5bff5935f9da
SHA1 hash:
a0ed97a319e7e8c3060736c8dce814391069208f
SH256 hash:
034495507ab786fe7b09eba3fdeaef3e79ac91d7ad334c60656fa76de798b918
MD5 hash:
6fb9a45764018529125658f618ac66d1
SHA1 hash:
7feeb52fa9c07c2467f176692093cae985bb09b5
SH256 hash:
47fd15e331cfb5293d7cbf2a6b390d7825afa79fd64464f74954ebde26c775d3
MD5 hash:
f040b23b1678e116d55f0e613e994d7d
SHA1 hash:
74ae3dccd6877cca78503a63a1e62e043f233670
SH256 hash:
dcc1725b855ec8f21f1a78a72bc3951682a20709b129d16051cbbbfca2361c2a
MD5 hash:
851857aa313098b41716720126d1e9e1
SHA1 hash:
748d3a025f04a0526678af71a341097570c88e7e
SH256 hash:
eeab28be5f4eec81010ccfcf39a44ac952fd7d1041dfbaeb78e6ba7d63078781
MD5 hash:
970fe017cf598e9f7438ac6c48e97d84
SHA1 hash:
2ebb8b06c7d1d986e62146c03aea20dd68573346
SH256 hash:
849cfd732df9b125423a39e469a811cd64edc0ce97e07d05ea1cbf77fef66df1
MD5 hash:
b36e06dc63d60cd81aa2378eedfdafeb
SHA1 hash:
1590b1a237ffa21912c810dc26920fdfbf6c608c
SH256 hash:
f45daafd61371b1f080a92eea8e9c8bfc9b710f22c82d5a06a1b1bf271c646ad
MD5 hash:
7e32ef0bd7899fa465bb0bc866b21560
SHA1 hash:
115d09eeaff6bae686263d57b6069dd41f63c80c
SH256 hash:
d6104fe3039b46f6da42e8d5c4330968e937edc83f74765b77954afd87defc8a
MD5 hash:
edd2f6f86ef1c561998bb91bb7c9ed89
SHA1 hash:
0f0314a872ddc9422eadc052a20f3c995aff8454
SH256 hash:
e7663a77d421e54fcd7bf1db27b3df8750b7342bbc5e2cfb28b3ba6c879fe908
MD5 hash:
777a6f070465d87a0bea066952204b1c
SHA1 hash:
ec346c28f676d9ce4e2df4e195ed737025434c7e
SH256 hash:
a5cb08b5c9d66e3751795d06b6a15ccfe0f5c30519cd151ca46ba550696714d8
MD5 hash:
457ebf3cd64e9e5ee17e15b9ee7d3d52
SHA1 hash:
bd9ff2e210432a80635d8e777c40d39a150dbfa1
SH256 hash:
9ebab0d71e72ff28f80b0c85aa2786f7e19d27c0fac61e69935f876294f05785
MD5 hash:
a5a3e43dd52ba845adc66f97737e80af
SHA1 hash:
22192dab18e74e1f807c77b2dfdf69ecbf8aa13c
SH256 hash:
012c3d22b5374c4f595fcf1986bf2a67697f322f36e8bb6456809334f98f5781
MD5 hash:
8bacb64db8fb73308faefd14b863fd43
SHA1 hash:
c5bf54f8b9cc198d6d380f3ee7a74df2feadf32a
SH256 hash:
9dac78cf97a753e813b02cb654f076cdea03155bc9a98ed64ec248729ead52ec
MD5 hash:
29fa5c5ade39d4ae5a0f564949278923
SHA1 hash:
376051004220051779d97fcb44065a8724de370b
SH256 hash:
4f7016fb630595204b4cb47d03f4cdf9a75597d2586fa9bbd244a0407a567748
MD5 hash:
ec94b9dbbb8502ae096f9d7e1f33901c
SHA1 hash:
d5f73eaaa6df419e83bb2c58f30d28ba2e348b72
SH256 hash:
12cf0ae7523596eb03fc1b8c12188b9a9a18b04dc9c7e43f68fa429a3b38f290
MD5 hash:
ff9dad972e2fea7ec4e51d06381b411d
SHA1 hash:
b64ca45947fcd5458113ead482d46734db723377
SH256 hash:
ce4a0e24eba6bc0243e43a93b7ad891f8919b60dd915ea9ae963d7ab3269a91f
MD5 hash:
d60af629ec5ccae618084facffa1e7be
SHA1 hash:
3c289ab1a89433aaa234d25459fe3c2bc0a40b85
SH256 hash:
9a0ebb089f2cf999998ad5d55a2c76497714f1c4cf07ce83a2e453f3bef27a83
MD5 hash:
b3befb3b54247f26442c39da72fd7496
SHA1 hash:
3d7348df986e723fdf2d5cb97a3325670639cf5b
SH256 hash:
74726437ae7ef6849f4844f19641d8b2aa967ba425b4cce1afbc5a8b67228bbe
MD5 hash:
e05e9140c5c31e1955f9ec1196cc9b34
SHA1 hash:
c7526dbeb852b8447b9a3570fdbd242d4ec1ac4c
SH256 hash:
967627d6777a79acef3e346afd94c2e207e9a843293b760599b890431c0ad262
MD5 hash:
47c68de899d5fe78472572d93906abdf
SHA1 hash:
f1b3643b9e8564ab7926230e9b687ec1a7b807bd
SH256 hash:
29d485a0958c6239f91cf00a0bf96aca62b3c40ffe53697256ad60ac83609473
MD5 hash:
ce4097287b3098b5a8c913077f2cb6b3
SHA1 hash:
9b446531045b7768ccb3a252ffa00a9569a35433
SH256 hash:
d7be9dd79cf4fa986176ec02fd2afcc9fa3c19aab9bc7b941f9fe07f9f42db67
MD5 hash:
4dec7c4bcf35367b7c7085d099f4d7da
SHA1 hash:
0164d660597e1150036397ee7a3b36cfa786df03
SH256 hash:
800175a19a10dae3a8acbbfec1291416b5babb144cbedd017c5a75c816687381
MD5 hash:
b1eb7d97d87b9e894a83a23f033777aa
SHA1 hash:
a9bfb137114e9ba56d7a36ae3cc2ab1aa54f742a
Malware family:
Raccoon v1.7.2
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.