MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 16


Intelligence 16 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee
SHA3-384 hash: 2bc08c151e2a8eadffe820856daae2982a3d9c3cbded06f69f3cc892432bce05a4fc636d96f9b03bde79e2204f574290
SHA1 hash: 4516984040b2a08c887db3d7503869a249def4e9
MD5 hash: 84bc4588647ce28be411b09e0f77c7ef
humanhash: beer-spaghetti-leopard-tango
File name:file
Download: download sample
Signature GCleaner
Create hunting rule
File size:3'649'824 bytes
First seen:2025-09-11 04:01:39 UTC
Last seen:2025-09-11 04:05:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 651e57d4ccb1a3162fc07a2bd253eedd (3 x GCleaner)
ssdeep 98304:c93UYGlnGP03HmpRYIYMJSYuvN9WeGnr0KxD08dU:c93UlEv7kBGgU08dU
Threatray 632 similar samples on MalwareBazaar
TLSH T138F5F1C22D717420C0387B3DEAF8B2361DD62E509DDD8DC63E939B4868A11567E781FA
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe gcleaner


Avatar
Bitsight
url: http://178.16.54.200/files/unique2/random.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
76
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
virusvippro.exe
Verdict:
Malicious activity
Analysis date:
2025-09-10 16:44:00 UTC
Tags:
auto metasploit framework github python payload amadey botnet stealer smb anti-evasion evasion phishing miner clickfix possible-phishing xenorat rat quasar generic networm amus tinynuke agenttesla remcos lumma stormkitty purelogsstealer xworm njrat loader xred redline meterpreter arechclient2 cobaltstrike tool stealerium asyncrat gh0st ransomware cryptolocker formbook pyinstaller bruteratel ultravnc rmm-tool masslogger screenconnect rdp vipkeylogger keylogger stealc reverseloader pastebin gcleaner purelogs autoit arch-doc arch-exec coinminer exploit crypto-regex
Link:
https://app.any.run/tasks/b46d8b41-efa3-4435-a2d9-1cf19710e6ee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/26800/
Detection(s):
no reply from clamd
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c249b6b20052598879a37f
Tags:
delphi cobalt emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint invalid-signature keylogger obfuscated packed packed packer_detected signed threat
Link:
https://www.filescan.io/uploads/68c249bcc62f699623887cfb/reports/16558f7b-c5f6-40b4-b356-ec7e13283378/overview
Verdict:
Malicious
Labled as:
Trojan.Delf.Agent
Link:
https://www.hybrid-analysis.com/sample/909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-10T06:35:00Z UTC
Last seen:
2025-09-10T06:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee/results?tab=lookup
Malware family:
RealVNC
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/af2d7742-7c4d-4d0b-8597-d99e06a2a9d2
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Suspicious
First seen:
2025-09-10 09:58:24 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=scmqlpeiadd6z3sjsqi3oqkyltxns3wpiyez2pggngql64gwehxa._file
Verdict:
malicious
Label(s):
gcleaner
Create hunting rule
Similar samples:
6235dad1b14fcc710ec252bf6c01de81535561490d45ce1255662eac8dcd0fe0
GCleaner
758e36455c17152210a6ae8001e3b9d7680159440e0e6ae702b9302ec2160d50
GCleaner
768f9ecc19a84b15234ead8058f24a9c8a337430312eab9ecbbcbfa8ab69d0f3
GCleaner
8a5850bb9793850879c2d4c5c040e120f404032161cf37d21ff5305601bf0b8c
GCleaner
a3a87de1728f004dbbef953cd7437e31b880206ea38ec809d870110a2ce4f6f0
GCleaner
aa586630eb5a50f271a1bdc1e20be4673b40a0c9b20433b7b2fcc0a65413526d
GCleaner
cfdf69d52382bf2c70df628d56ec1464f5318533840313aa951c408f7ce3f8e1
GCleaner
efc00dd0896804d8bab9f90b3067e07b14fbbefc170eb3952d5976972eceb6c4
GCleaner
+ 622 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner discovery loader
Link:
https://tria.ge/reports/250911-elre6afr4x/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
GCleaner
Gcleaner family
Malware Config
C2 Extraction:
185.156.73.98
45.91.200.135
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/652ce042-b939-4e98-99a4-0629cc515cfa
Unpacked files
SH256 hash:
909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee
MD5 hash:
84bc4588647ce28be411b09e0f77c7ef
SHA1 hash:
4516984040b2a08c887db3d7503869a249def4e9
Link:
https://www.unpac.me/results/f6d5241a-2c02-4375-894d-8167328b6009/
SH256 hash:
ad4975580d4aed4e0907419c267ab01c8fc153a0b1a31d6af5072dc90482e04e
MD5 hash:
e9f50e18d15e682c7254d71af317b26e
SHA1 hash:
4121448a31ebb44880711fe3adba72306f61d0d5
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/f6d5241a-2c02-4375-894d-8167328b6009/
Parent samples :
e1cffe1faffd2a399f833405e2b28960f35ed3ec9dcb9cfaeb2d66f27eccba47
44a56311320ac072e7ddd1972530e7c64631692863cda2193596905ae30311c3
b651d0039a9d6f2383eb3b20eb9712f0fe19d3c96d1a6d6d3481c87cdc94cecc
32c7b0e8a4cc49535ac3925c1208e7740cb9a10fa0b8321cd0b1bc7f3895b230
6cb852252bd2c139c287968e9b3fc186d280dad584e5ea2787aea6182823a0fa
43998d323172b680b5e11457af870adef4f0593eb3c35a0eccbbc172e15cf068
147d8db1e9c0a4ff6ae8b02342054c3d9a8d4d7ea25ab3adea6641cde8c7d065
01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231
971df451fef89fe86b63a6d9191ffcb98eb80c579b371cd5a90239eaa0b57380
32f78d28504cd4cd30e6c0cba38470ac864234f98a0c8620e37ffe3040add185
6435e02f13a75d9f7fc4bf6cd61e2fcd26969d593f446652796fdf26e3dbd50d
c95aa4a24dedd352cc74f59d5beba29384138c604d796c4e3d4debfbe46899f0
a9155d359d4294909b94945b43251042bce6829d435b1657de73ba898ab35baf
5d2aa06683b97850ac113ccb35dd95c0bdf319c4d0b234e49e8e520fc99c45ac
f21e1c8d6ba7bdf68d3d6f7b683bfa8e5916bda1308e53bd04c89f9d6fff71a7
52bf70e9234332ff325a528581108b749a7e1969143de186a56fb4632ebf4c89
2d899ab191f2c6384d1a9a778bb9488d8584fe13511788e00aa6e97fd932c083
dcd8e3d44e64209ecedf0a61970775a979e1216b540e2d2d07f4e71dbe76ef15
cfdf69d52382bf2c70df628d56ec1464f5318533840313aa951c408f7ce3f8e1
4eb6747cdf61ae87a0c64bd86f49ddf65c61397958a81b33d788dcdcbf61329f
e4995bb20cc990503030d8a67449d3481832f904854892f8b2c4eb0ea05342fd
142a11b087745d831e0298f74f8f39a3fcf4a0dc3035c8bf1bb95517ca59fec3
a3a87de1728f004dbbef953cd7437e31b880206ea38ec809d870110a2ce4f6f0
bdc1e5fc3bcc906b2b551ef2fcf7e744ac54abc8641b5c1e4e0a06c0612f080f
0f82e3f84d0bfdf516099765e67bc0de58a71e2003ad8682a6bd7ff162c8880a
62f17c59bcec354bbfae7a31d549899510fa73345a735684d154eae6bac76daa
a6f22f51bb87c6c02099ffa86c9df12bd8da32f26f0904167ba2361d655fe8be
8e8eacde053628227873d4ebe3a6e4ea992916f204e6e68866b3fe2af8a5ebb2
b89436a6105fe4c036ac87b0c893d84fc6b7a6e848b634c47d0dc5dae7560b7d
9cb2f4a1fc1bc3bd4ca73397789fc0ef9305e42ca539efd8df878ae4fbc2822a
3c1b34a16bc34c149c8c2c3d516527ed6c4c913d9bf8ac47e35a79675075fe67
15a8b61d0bb9b83ee97c6a44f309f2fd2dbad2fa4cfc76af46c98edf9bc0e238
cdb8d74735fd803936cbb3f259418fa76aa5fa7ad03f8cba3b7d310006052e61
1f5ede5de37e1dd4b8242bea76ca13391cc0c3118d949282a91eb95b7ae932a5
d8c44f8a58899360bf30a527082c917bae7b564db5f129f2517a5deb39ba9ff2
050f2713c672fef785c006ad7243e5ed913fa5a396cb2739f0ceaf1ddadadaa0
1a3a2be484d8f6e4a3458ef3c259f13497fc5c10062458c6b2c4373005a3d7fe
75ebdbe16e4e04a657bb1a54f48b6951d1b0a191e79f27d2dbdbf2a4afe929c3
04651b5ea2f5abd76dfffd4630d54ca23bf2a3c30f53e4ccc213f0f669b7e834
65bd0eb4a9c5160b367263e494eebd87dfb74a3032f7acf0f09bb707c0dc2ef2
c3079b1f05b25daaf2add658fdb3f6fddf0c24828142e2234fa8d51b8c8b286f
e4ac1d6f7663f39195e33c4f8da181129b549bfb4b979b7b5990d387ceab128f
67e77189393add966f9e78d19ae43c10ac6b4e8a1db113d04d244e54176985c1
a77c449da95f2a52fc2f4e56e97d18ffa65c52c5475e46f31fb6b2d75b858de6
aa93f1d9999282fbd664e0fa6c9a17413e4ae72ffda564ef915d1a4c00c6218b
cb15de5f46531f8027182000f0c961cb20c4815e992ac8810198cee869bbeb20
fea6875b7e1c0ad8ac615f9d92213b8a9947182dce38c48f2a2e4362acb1a761
d9437b6f08ccecaeba0f25a6eeb2536b72fe8cf2fbe56c127e823ef148653a6f
dfc525e8f983d4bd66ee6dfd4b747e2c981e76e90870a16a9d1df80742b72583
96576ba536ec988cd9c9ad747d77f8fce85e41d14c864a15788c10294b2d02d8
7f7cb842f6e44063f2c77900afae5237d87bdf0d4445abe6e5ea5dd02cf16fcc
1271b5b2e962be9c8da10a8e507b3fd6480a00219ff1c890169d9aa0bb9f234b
c18e539301e1d8e4676e169ef1a5708e7f225689e599726cf51a731935ffb14b
fa47e000ed767d0ab02b6500ccd02bdb0cdaec3892c01a1998a51d3d44a146d8
8f4fd966a0cfe7f2c45f8f0d7a9edc9e6de0623e9f5fda877a4c7c4cf9ee383b
dd9d04563791f4a07d867829bd4ee3d8d6058b0e1ad08ac54a8f2969b53d4d58
ee61018202eadb79f35a3ee4132766f9f4a08ba4dbde38148f4ccc0e58b7d223
ccbda9594a4811b44768ad404fa6c8ff3cd95de5915d8120c3bb66261348b5ef
8eb8647daba57087ab2641d3b20f1bee24fafc72b3b1a5254aa3baa6e79b494a
8450ab027023f8787201965f14dcd4c9dbebda482384f1517767b5fc137d89c7
6557410235018ef55b87a36a66cadcbecd3f028313bfc6d4fded104536cff8c9
aa586630eb5a50f271a1bdc1e20be4673b40a0c9b20433b7b2fcc0a65413526d
909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee
e7f7a21ee9aaf1f982d222aa7637f8f32c88c44e0b24d9a470fe5ccc47ee55fe
74273805a7bd7441f36bdc596eff7b4597c254015727024c2e86717d8954bbe3
e0c21356fdd99942e1d9e89f0afee73e5f14772bf5f8836ab8b96a997ba76768
a639d8ed17108b7cf50aa15e689f62c03a04b409a6204249d0f9503b55d888bd
2203c96ef56407f1c2b8ec820b89beb20ca0d31bc0ba7a4fc21fb99ab67e18ee
b13f24b087cdcd13ceb92ba139fdc48d03fd5f2c394984c4fd4aa2286ca1e81b
e470c9662b570ea239ed7b599322559bc86d2f150dfc5e2503d083b40da3cd89
e6ce0c13aaf5187d4ef76420af9ccd486262292f0c1e68a2f0c25b7c8be4cd09
110fd095374fef103943ce10fcf71d8619dbe65011ad9893bc0fe3b8a24d20c8
b43fe5810af7c86f8b5165f90c607e1d99fc97b2b69e3ff72e14b09a00620fb3
5807f7e7d5b0240ae218cb9e7c50fbdbbe2ea66007c4276b5ad4e7ae4c4b94fd
0829c26f3453be9269c2e48dd3393d7f5e1dc843e4ce309da7704b5e6ac3aa21
e8bd4db9b069b622540be5f46b4fdd426d1488dc6841625d8a5c0ce9b9f652b1
2e543ea9d1bd67be3ae38732a9758c09a9d784d46b1edf0e808c1783c215ccb0
30c323c6e772d3c7648fd6b0306530a0ff9170948cebf9789f73cc25f1de9722
d64773ce84da74f11e774bee4cdfc873e283a0662546d0bd898b800f3a766c90
SH256 hash:
0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c
MD5 hash:
4ce3ce196eda86d92b68362b6269b618
SHA1 hash:
fd42ee0aca0315acac25c297f1ce33634c549559
Link:
https://www.unpac.me/results/f6d5241a-2c02-4375-894d-8167328b6009/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe 909905bc8800c7ecee499411b741585ceed96ecf46099d3cc669a0bf70d621ee

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3617799/
Cape
Cape
https://www.capesandbox.com/analysis/26800/

Comments