MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 16


Intelligence 16 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
SHA3-384 hash: 40847b47ff510e96d81d213197b595ec36fd9adb89f604603e1fcb0cfbb3d9a4c0e241834f0f536d307ae99be03b5c3c
SHA1 hash: 1b991b041a322eb95b45148b33887c8bb04709fb
MD5 hash: 171fdd75a7d369d656dbd9145bf17695
humanhash: washington-florida-south-snake
File name:Soft.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:3'795'744 bytes
First seen:2025-09-05 17:56:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd46f408207f13baa837940df074f4e9 (18 x GCleaner)
ssdeep 49152:GorVR8j0er0o6nd2NWh7bDHYgNO+UFWNA5ItvQYDcIzW5U57P90cc0TfGrZRqEqe:Gorkrf6Jb0gNLCYv1zIoXTfGrZsDIj
TLSH T19806F10EEC618476F07E3BB4CCCD64AEA5E679E12589610BDEFC4BC84B245516B04EB3
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter aachum
Tags:exe gcleaner


Avatar
iamaachum
https://download-trust.eu/kmspico/ => https://mega.nz/folder/zLIhTbqK#-5e9Vq6eWDPxlpTAKFK9vQ

GCleaner C2: 176.46.158.23

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Soft.exe
Verdict:
Malicious activity
Analysis date:
2025-09-05 17:59:40 UTC
Tags:
lumma stealer gcleaner loader autoit auto-startup inno installer delphi
Link:
https://app.any.run/tasks/a8a40151-d13b-431c-beeb-f0bd9676f902

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/25886/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bb2454eb163e0ec1849a0e
Tags:
delphi emotet cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Connection attempt to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint invalid-signature keylogger lolbin obfuscated packed packed packer_detected remote signed threat
Link:
https://www.filescan.io/uploads/68bb248c37c25fcf12d50ac3/reports/54cd1531-7184-4fba-87e2-5adefba4a3de/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-05T15:04:00Z UTC
Last seen:
2025-09-05T15:04:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.Win32.Agent.gen HEUR:Trojan-PSW.Win32.Tepfer.gen
Link:
https://opentip.kaspersky.com/82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897/results?tab=lookup
Result
Threat name:
CryptOne, GCleaner, LummaC Stealer, Sock
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1771992
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates / moves files in alternative data streams (ADS)
Detected CypherIt Packer
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found strings related to Crypto-Mining
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries Google from non browser process on port 80
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: Potentially Suspicious Child Process Of Regsvr32
Sigma detected: Powershell launch regsvr32
Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected LummaC Stealer
Yara detected Socks5Systemz
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1771992 Sample: Soft.exe Startdate: 05/09/2025 Architecture: WINDOWS Score: 100 140 185.156.73.98 RELDAS-NETRU Russian Federation 2->140 142 45.91.200.135 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Netherlands 2->142 144 13 other IPs or domains 2->144 162 Suricata IDS alerts for network traffic 2->162 164 Found malware configuration 2->164 166 Malicious sample detected (through community Yara rule) 2->166 168 20 other signatures 2->168 14 Soft.exe 2 2->14         started        18 CadmusDrive.bat 2->18         started        20 regsvr32.exe 2->20         started        signatures3 process4 file5 130 C:\Users\user\AppData\...\svchost015.exe, PE32 14->130 dropped 132 C:\Users\user\AppData\Local\...\svc3DC5.tmp, PE32 14->132 dropped 182 Writes to foreign memory regions 14->182 184 Found hidden mapped module (file has been removed from disk) 14->184 22 svchost015.exe 31 14->22         started        186 Query firmware table information (likely to detect VMs) 18->186 188 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->188 signatures6 process7 dnsIp8 146 176.46.158.23, 49688, 49689, 49690 ESTPAKEE Iran (ISLAMIC Republic Of) 22->146 148 drive.usercontent.google.com 142.250.80.97, 443, 49686 GOOGLEUS United States 22->148 108 C:\Users\user\AppData\...\rqsa65Ntwk.exe, PE32 22->108 dropped 110 C:\Users\user\AppData\...\lSAXp8PT1uKpQ.exe, PE32 22->110 dropped 112 C:\Users\user\AppData\...\4rgH5sPswQ.exe, PE32 22->112 dropped 114 3 other malicious files 22->114 dropped 26 lSAXp8PT1uKpQ.exe 2 22->26         started        29 4rgH5sPswQ.exe 22->29         started        31 rqsa65Ntwk.exe 26 22->31         started        file9 process10 file11 116 C:\Users\user\AppData\...\lSAXp8PT1uKpQ.tmp, PE32 26->116 dropped 33 lSAXp8PT1uKpQ.tmp 18 26 26->33         started        118 C:\Users\user\AppData\...\4rgH5sPswQ.tmp, PE32 29->118 dropped 36 4rgH5sPswQ.tmp 29->36         started        120 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 31->120 dropped 38 cmd.exe 1 31->38         started        process12 file13 82 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 33->82 dropped 84 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 33->84 dropped 86 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 33->86 dropped 92 21 other malicious files 33->92 dropped 41 flashdriverecovery4488.exe 33->41         started        88 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 36->88 dropped 90 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 36->90 dropped 45 4rgH5sPswQ.exe 36->45         started        176 Detected CypherIt Packer 38->176 178 Drops PE files with a suspicious file extension 38->178 47 cmd.exe 4 38->47         started        49 conhost.exe 38->49         started        signatures14 process15 dnsIp16 152 66.63.187.153, 443, 49694, 49819 ASN-QUADRANET-GLOBALUS United States 41->152 122 C:\ProgramData\...\sqlite3.dll, PE32 41->122 dropped 124 C:\ProgramData\...\FlashDriveRecovery.exe, PE32 41->124 dropped 126 C:\Users\user\AppData\...\4rgH5sPswQ.tmp, PE32 45->126 dropped 51 4rgH5sPswQ.tmp 45->51         started        128 C:\Users\user\AppData\Local\...\Parker.pif, PE32 47->128 dropped 55 Parker.pif 5 47->55         started        58 extrac32.exe 21 47->58         started        60 tasklist.exe 1 47->60         started        62 2 other processes 47->62 file17 process18 dnsIp19 98 C:\Users\user\is-88OQL.tmp, PE32 51->98 dropped 100 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 51->100 dropped 102 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 51->102 dropped 104 C:\Users\user\9LightCyan.dat (copy), PE32 51->104 dropped 170 Drops PE files to the user root directory 51->170 64 regsvr32.exe 51->64         started        150 digitbasket.com 129.226.128.168, 443, 49693, 49695 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN Singapore 55->150 106 C:\Users\user\AppData\...\CadmusDrive.bat, PE32 55->106 dropped 172 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 55->172 174 Query firmware table information (likely to detect VMs) 55->174 69 cmd.exe 2 55->69         started        file20 signatures21 process22 dnsIp23 134 mta5.am0.yahoodns.net 64->134 136 80.66.75.39, 425, 49703, 49711 RISS-ASRU Russian Federation 64->136 138 11 other IPs or domains 64->138 94 C:\Users\user:.repos, OpenPGP 64->94 dropped 154 System process connects to network (likely due to code injection or exploit) 64->154 156 Suspicious powershell command line found 64->156 158 Creates / moves files in alternative data streams (ADS) 64->158 160 2 other signatures 64->160 71 powershell.exe 64->71         started        74 powershell.exe 64->74         started        96 C:\Users\user\AppData\...\CadmusDrive.url, MS 69->96 dropped 76 conhost.exe 69->76         started        file24 signatures25 process26 signatures27 180 Loading BitLocker PowerShell Module 71->180 78 conhost.exe 71->78         started        80 conhost.exe 74->80         started        process28
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/171fdd75a7d369d656dbd9145bf17695
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-09-05 17:57:22 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qk7t5cmruixwpzoptnzub2z4d6suk3e5tkpcp7oba7cgk4trhclq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250905-wjdvqa1ns7/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/052ab179-0cf3-449d-86ae-834986b07b58
Unpacked files
SH256 hash:
82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
MD5 hash:
171fdd75a7d369d656dbd9145bf17695
SHA1 hash:
1b991b041a322eb95b45148b33887c8bb04709fb
Link:
https://www.unpac.me/results/548f989a-ac75-45e7-ab51-7db5ee15ce6c/
SH256 hash:
5a5ed78e04c7ad144a4580c19e9743d252b4a25e84ba7e6c4c43fc459c956a9a
MD5 hash:
8aadb7e2a4e0128b357b6e90d924d128
SHA1 hash:
cfc4678d82f0e4b0cebd1fb0b01f479dc25134d5
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/548f989a-ac75-45e7-ab51-7db5ee15ce6c/
Parent samples :
2046f265e025776e7199a9e576be5ed49483841f5203c3e3eeb79d0a24f73920
384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
768f9ecc19a84b15234ead8058f24a9c8a337430312eab9ecbbcbfa8ab69d0f3
aba7585008a92523b09b28c94fdd8fb7afc39b5b466efac8ca5f7f2b520bbedd
ca4a5fcd9eff405f9f8037e89e1a72914eda7129e5aa9476283021c03c56500c
c5e135c050b4ecbc73acae15b6dbbfaf5157e60fe62c96913b4c56df77ae4feb
dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
c582323df2a900ae3b0b1860ff768aa5e90f3e595b33aecb57040b130a65e632
e65f22bbb7a32f6fd436eb0ea6de0c000542ffd6785a983d8f0594b791331994
70cc21383260ea0cb520627324853ae7665cb4b8f6462c5a96e07375a2c26317
3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
408ef63acd027f6ba843e30d00d51e506d714804ee842a83f4f31a4b5d7aa7d9
f62ad9ecb4facb02dead75e27e29db58519b6805f49278852d02298b55e59cf5
758e36455c17152210a6ae8001e3b9d7680159440e0e6ae702b9302ec2160d50
a91a863821ef21472adfeeed5e90eebf3fe5e559f257f7d37de401c2a0553485
8b2d9358a329089c3bd96cce97b91e9b8a4d900abd0aaa8e55c3c0466e930c88
9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3
e41b1aa6ff791b7611638851db2ba42c47a125a81b5c74d10354f4f87d4e8770
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
05664da4d3ea8b39b6183a1112e67f46a8715536faa0a9469bc2659f4ef16289
d3a77d8bcd9963d30fd3e51acee6654e3ccbf2b2b81fbe47e97b9b9068c76f06
1a757566caa5edd32fd5c190b9e8da7d7abf3398b9a3ceddd365a95886434767
53afe13ca6d157bec8b1cc467764abd1194fb3bbd06c0a67a2ee5f560b63d1a4
82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
512b629f01ce1668bcc60ea305e93fb264cf2b7f2f87bb3aafef29beeb604cce
cc261502042db67adb917ce03321ee47277cfbc1712b770c6b71c035b89793cb
477df2a52197bd71524c4ccf192ce2d2afb8b4b3d8e33f8efa418910342f30e7
a53952ad1b88e5d6b4fc14f09e4ccd0f2ce4be72df7c5693abd8cdad953a4871
5dfcdc1c491fbf2f7f2fbac6bbf27b84be652583b66b252c46e8ed86577c3c60
SH256 hash:
0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c
MD5 hash:
4ce3ce196eda86d92b68362b6269b618
SHA1 hash:
fd42ee0aca0315acac25c297f1ce33634c549559
Link:
https://www.unpac.me/results/548f989a-ac75-45e7-ab51-7db5ee15ce6c/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/82bf3e8991a2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897

(this sample)

  
Link
https://tria.ge/250905-v34ptafl4w/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/25886/

Comments