MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GCleaner

Vendor detections: 14

Intelligence 14 IOCs YARA 22 File information Comments

SHA256 hash:	9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3
SHA3-384 hash:	02ca60742a2346793347b4f49be5cd3bda35510b3fc59c0ecdc75e55d42a121bc26839d0fd151b2d0b2bcb8434dc19b3
SHA1 hash:	443f7edee422678855431851c2b1d5f43be46184
MD5 hash:	dcc7d7a4a07f47f9ab66a2c902f161bb
humanhash:	oklahoma-crazy-spaghetti-high
File name:	Soft.exe
Download:	download sample
Signature	GCleaner Create hunting rule
File size:	3'472'160 bytes
First seen:	2025-08-10 21:06:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	085c732dcd123fa9e0760a6a98b6faa4 (8 x GCleaner, 1 x RedLineStealer)
ssdeep	49152:qDavqFKoA/twUGbDDbuQb1Rbj5mGI95FbAGQJ7fU4jbW0RkwJnxi5+t4VoNkPS:qDaS8omIHyAVYGI7FTQJ44XZWCn7l
TLSH	T10DF5025151A0D66FCEBA077CB43A82B06C2F7F8074BE99F6D8E10CD9CB6C052B4B5592
TrID	52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4) 16.8% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23) 7.5% (.EXE) OS/2 Executable (generic) (2029/13) 7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter	aachum
Tags:	exe gcleaner

iamaachum

https://download-trust.eu//Download.html => https://mega.nz/folder/jtg1DSqR#KARWjGq6m4hNelDO0L-lIQ

GCleaner C2: 176.46.158.23

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Soft.exe

Verdict:

Malicious activity

Analysis date:

2025-08-10 21:06:51 UTC

Tags:

gcleaner loader

Link:

https://app.any.run/tasks/18a4cb0d-aaf6-43a5-be8d-c453d2e7f44d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/19993/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68990a0ec633abe3908da291

Tags:

delphi emotet cobalt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Creating a file in the %temp% directory

Creating a process from a recently created file

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Unauthorized injection to a recently created process by context flags manipulation

Connection attempt to an infection source

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3

Malware family:

RealVNC

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/42868fbe-3859-4a6d-aa44-de4df4efbbf9

Result

Threat name:

CryptOne, GCleaner

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1754151

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Found stalling execution ending in API Sleep call

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected CryptOne packer

Yara detected GCleaner

Behaviour

Behavior Graph:

Download SVG

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3/

Verdict:

Malicious

Threat:

Family.GCLEANER

Link:

https://tip.neiki.dev/file/9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-08-10 21:07:25 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=szj7wjtto2vbjfmznwjvvc5yw3ltwrvkg4wycs73hsi3udv367zq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/250810-zye8wasqs5/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/6684279b-9448-4e04-a13f-bd6d46bea4a0

Unpacked files

SH256 hash:

5a5ed78e04c7ad144a4580c19e9743d252b4a25e84ba7e6c4c43fc459c956a9a

MD5 hash:

8aadb7e2a4e0128b357b6e90d924d128

SHA1 hash:

cfc4678d82f0e4b0cebd1fb0b01f479dc25134d5

Detections:

GCleaner

Link:

https://www.unpac.me/results/e5fc09e7-62f3-48a6-811f-40f880c04085/

Parent samples :

2046f265e025776e7199a9e576be5ed49483841f5203c3e3eeb79d0a24f73920
384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
768f9ecc19a84b15234ead8058f24a9c8a337430312eab9ecbbcbfa8ab69d0f3
aba7585008a92523b09b28c94fdd8fb7afc39b5b466efac8ca5f7f2b520bbedd
ca4a5fcd9eff405f9f8037e89e1a72914eda7129e5aa9476283021c03c56500c
c5e135c050b4ecbc73acae15b6dbbfaf5157e60fe62c96913b4c56df77ae4feb
dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
c582323df2a900ae3b0b1860ff768aa5e90f3e595b33aecb57040b130a65e632
e65f22bbb7a32f6fd436eb0ea6de0c000542ffd6785a983d8f0594b791331994
70cc21383260ea0cb520627324853ae7665cb4b8f6462c5a96e07375a2c26317
3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
408ef63acd027f6ba843e30d00d51e506d714804ee842a83f4f31a4b5d7aa7d9
f62ad9ecb4facb02dead75e27e29db58519b6805f49278852d02298b55e59cf5
758e36455c17152210a6ae8001e3b9d7680159440e0e6ae702b9302ec2160d50
a91a863821ef21472adfeeed5e90eebf3fe5e559f257f7d37de401c2a0553485
8b2d9358a329089c3bd96cce97b91e9b8a4d900abd0aaa8e55c3c0466e930c88
9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3
e41b1aa6ff791b7611638851db2ba42c47a125a81b5c74d10354f4f87d4e8770
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
05664da4d3ea8b39b6183a1112e67f46a8715536faa0a9469bc2659f4ef16289
d3a77d8bcd9963d30fd3e51acee6654e3ccbf2b2b81fbe47e97b9b9068c76f06
1a757566caa5edd32fd5c190b9e8da7d7abf3398b9a3ceddd365a95886434767
53afe13ca6d157bec8b1cc467764abd1194fb3bbd06c0a67a2ee5f560b63d1a4
82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
512b629f01ce1668bcc60ea305e93fb264cf2b7f2f87bb3aafef29beeb604cce
cc261502042db67adb917ce03321ee47277cfbc1712b770c6b71c035b89793cb
477df2a52197bd71524c4ccf192ce2d2afb8b4b3d8e33f8efa418910342f30e7
a53952ad1b88e5d6b4fc14f09e4ccd0f2ce4be72df7c5693abd8cdad953a4871
5dfcdc1c491fbf2f7f2fbac6bbf27b84be652583b66b252c46e8ed86577c3c60

SH256 hash:

0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c

MD5 hash:

4ce3ce196eda86d92b68362b6269b618

SHA1 hash:

fd42ee0aca0315acac25c297f1ce33634c549559

Link:

https://www.unpac.me/results/e5fc09e7-62f3-48a6-811f-40f880c04085/

SH256 hash:

9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3

MD5 hash:

dcc7d7a4a07f47f9ab66a2c902f161bb

SHA1 hash:

443f7edee422678855431851c2b1d5f43be46184

Link:

https://www.unpac.me/results/e5fc09e7-62f3-48a6-811f-40f880c04085/

Malware family:

GCleaner

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9653fb267376/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

exe 9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3

(this sample)

Link

https://tria.ge/250810-zfqa5avyaw/behavioral2

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/19993/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample