MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GCleaner

Vendor detections: 11

Intelligence 11 IOCs YARA 5 File information Comments

SHA256 hash:	9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9
SHA3-384 hash:	bfec0e24690f1b7cbbe2ea32f972b21e55ab41a871492959ed803cdb6a311637534f7140507aef6b384cc3640c5654b6
SHA1 hash:	812e1a9bf2b6a9d6c7b594cc67081c84a0ed037b
MD5 hash:	ec0047471fd06927dcb6dad869f84231
humanhash:	arizona-fanta-july-robin
File name:	file
Download:	download sample
Signature	GCleaner Create hunting rule
File size:	894'976 bytes
First seen:	2026-03-20 20:58:30 UTC
Last seen:	2026-03-22 00:05:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	62848721a0fe32270ffbda7abe4e1f5c (4 x GCleaner, 1 x AmateraStealer)
ssdeep	12288:7YEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988faN:7bJIJ4TiIaBYfTz9wC3pKqH8faN
Threatray	826 similar samples on MalwareBazaar
TLSH	T1B715291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 gcleaner

Bitsight

url: http://158.94.208.7/files/7776573655/8RPb9TK.exe

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoHotkey

Details

AutoHotkey

an extracted AutoHotkey script

Link:

https://research.acce.ciphertechsolutions.com/results/a909f7df-4b1e-4cd7-ad3c-a7e86ca6ec15/

Malware family:

n/a

ID:

File name:

file

Verdict:

No threats detected

Analysis date:

2026-03-20 21:01:05 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3b4de913-267c-4fa5-8af2-0f66ed475682

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

ditekSHen.MALWARE.Win.Trojan.RedLineDropper-AHK.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69bdb52688c80c01586c87d0

Tags:

redline autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending an HTTP GET request to an infection source

Sending a custom TCP request

Connection attempt to an infection source

Gathering data

Verdict:

Malicious

Labled as:

Trojan.GenusC

Link:

https://www.hybrid-analysis.com/sample/9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9

Verdict:

Malicious

File Type:

exe x32

Detections:

UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3e787343-11c2-4648-b8bc-7e2f189af58f

Score:

70%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2026-03-20 20:59:20 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

10 of 38 (26.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t4t235iudlito2rngg7moonqyrsojeb6bl6nez5l6oap7bt2rhuq._file

Verdict:

malicious

Label(s):

admintool_autohotkey

GCleaner

475525d4cbab512f143238013112efa360de9fa46dbba201a7219d50c69e0697

GCleaner

7ed95ba34ca8cfc40494ca5fb3f9c4253190eaf6dae23c99dbce8c1c55f82b3f

GCleaner

7ffa3011fcb679f93ad497805584a5808ad224091b74f774b46e41fb337bdd4e

GCleaner

9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9

GCleaner

error

GCleaner

+ 816 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/260320-zst5vacy3v/

Behaviour

Script User-Agent

System Location Discovery: System Language Discovery

Unpacked files

SH256 hash:

9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9

MD5 hash:

ec0047471fd06927dcb6dad869f84231

SHA1 hash:

812e1a9bf2b6a9d6c7b594cc67081c84a0ed037b

Link:

https://www.unpac.me/results/fd8cd096-d66f-472a-a4f2-6dcb12a68695/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.