MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34
SHA3-384 hash: 6892f2c6a8d8bddb22a63d1fbdf6aadf47f946e6db91315d84deb0516824c73a1c7499a5edcd1477c755c0384fed47d0
SHA1 hash: 2db1258c65b520aa3ec1e1dee05fb2ec873b1b5e
MD5 hash: 4fa87961cff1e72a079c2d1acdcf2fc1
humanhash: cold-whiskey-lake-lion
File name:4fa87961cff1e72a079c2d1acdcf2fc1.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:354'816 bytes
First seen:2022-06-14 08:27:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b88da3f1e73518bb3e8d17092b704138 (3 x Loki, 3 x Amadey, 2 x Smoke Loader)
ssdeep 6144:3mRN6CZo0/H3nIAksBqZBIYAo3Wl6ntKbH3AIJEJ9kKBP1:3mR0CZlv3nIAk6gIYA4WgQbHQIW9jBt
TLSH T1F074CF00BBA0D035F5B712F44ABA9368B93EBAA15B3450CB52E556EE5B347E4EC30347
TrID 40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.0% (.SCR) Windows screen saver (13101/52/3)
13.6% (.EXE) Win64 Executable (generic) (10523/12/4)
8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 36f0c8c8c8d8e862 (3 x GCleaner)
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
235
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
4fa87961cff1e72a079c2d1acdcf2fc1.exe
Verdict:
Malicious activity
Analysis date:
2022-06-14 23:52:01 UTC
Tags:
loader evasion trojan opendir rat redline
Link:
https://app.any.run/tasks/09852953-28a5-40ff-a461-95d91107b369

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Create hunting rule
Link:
https://www.capesandbox.com/analysis/279679/
Detection(s):
Win.Ransomware.Ransomx-9943921-0
Create hunting rule

Win.Packed.Pwsx-9948390-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending an HTTP GET request
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/21129/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/62a846d48763ffd4adc2734a/reports/8ecc4a47-d466-442e-9f5b-0c26559e0742/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3bb7cc5e-177b-4781-8d8e-ca7c1cf7b15a
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1012751
Signature
Antivirus detection for URL or domain
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Nymaim
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34/
Threat name:
Win32.Trojan.Raccrypt
Create hunting rule
Status:
Malicious
First seen:
2022-06-14 08:28:09 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wfh3dmi4z6lzhejkdo62tibhyaohkfkrgwy4wf33o7an46snnm2a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220614-kcz9lachep/
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Deletes itself
Unpacked files
SH256 hash:
a0b348ae08664e5ccc0f3596020aecc5cc779c56b1db07f726a163a152cd9457
MD5 hash:
0eea16edb874efb6cbbf2d1dc71c6480
SHA1 hash:
c948bd3f07e1785a160d272c533d2d11fe79cf7c
Detections:
win_nymaim_g0
Create hunting rule
Link:
https://www.unpac.me/results/85e9f567-4f22-4038-8eaf-f5bfd9f27f01/
Parent samples :
b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34
45f64ad405eaa4ed35eb74b4e773cb1041c377abdc2b80599168018a2e1406bc
4eecbfc54480c8b8e98d3abba71b70d63575355141f4892a55d49631841ebfba
190a63203f7970e14c4f9f886ad814bbb5b30160dcba66d22b78583baaae478e
d97409bc67beeca578cfa94b5058501dd8951e4206a18a019702e039966a22dc
81a110de18613503c0f3075da56cdbe363091cebcd8c52423ac1d63aa791bb22
cd8fdfee914d46d345bedd2868f2aec93c48fd00385492e377793f06cd42dc1f
6763b0b45f0fd8e32e29377a207058fc42a02bb6d1db368c76fd0af470abc341
5ec64b926c9e2f1d2c69f92b69b5c9169b23d533f327ac944776e8e266eaab99
SH256 hash:
b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34
MD5 hash:
4fa87961cff1e72a079c2d1acdcf2fc1
SHA1 hash:
2db1258c65b520aa3ec1e1dee05fb2ec873b1b5e
Link:
https://www.unpac.me/results/85e9f567-4f22-4038-8eaf-f5bfd9f27f01/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe b14fb1b11ccf9793912a1bbda9a027c01c75155135b1cb177b77c0de7a4d6b34

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2212368/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/279679/

Comments