MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a
SHA3-384 hash: 31da139288b898e8e08dbafe399ad7c064c9a8d76add5f0f412b838c33c8b9e5a6f47a8b2263c072fa60675ee56eea3f
SHA1 hash: 11c985eab5e756bb43b4d6f878091cfe96883459
MD5 hash: 6b29a6f6f98275a0e4df9db15c8170a8
humanhash: uniform-quiet-alpha-spring
File name:6b29a6f6f98275a0e4df9db15c8170a8
Download: download sample
Signature GCleaner
Create hunting rule
File size:312'320 bytes
First seen:2024-02-27 06:18:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 85d120fa1d3b952ae395bf2cc9884de1 (1 x GCleaner)
ssdeep 6144:jxRVPIm7BeH7dEn6iVcZ17Vlk3mQbpYaWCAx:jx/PIm78K6im1Y3mQbpyB
Threatray 42 similar samples on MalwareBazaar
TLSH T19264E11176B2D832CA9756754C25CFA81BBF78315A38924B3BA5277EAE702D05F32313
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.1% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon a400c8c0dce97284 (1 x GCleaner)
Reporter zbetcheckin
Tags:32 exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
345
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/477912/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint packed
Link:
https://www.filescan.io/uploads/65dd7e9b26f1ddc579abbc80/reports/d3e74bdc-4a74-4d95-b09b-fd72705964ee/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b8d0f1a5-c926-4043-a2cd-5f73d68f62d4
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1399254
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Nymaim
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2024-02-27 06:18:05 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjnql6vpbethswkragpcbep6n6uf2j6oqiltjoovy73zidjidsna._file
Verdict:
malicious
Similar samples:
03b8ef63390d4611b8caf0670192d03037c0ab000ab9ac4af49fb10043b2a34b
GCleaner
082f154beda748e88461ef9abba845d25a808d155ab05c3ac5c7acac73d9dbf7
GCleaner
3ee657f2d817677e7e01d6322d543872cac9e71a1d75d15b18f50c7624e2d1fa
GCleaner
7ed3472328e44f3892fe722654c4be8ae36b0cf2b66b425701cefb2d513b4648
GCleaner
93ec2ec0642b25a29aed1d05ba9ef46dead00a0515384da571596583d108182f
GCleaner
+ 32 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner loader
Link:
https://tria.ge/reports/240227-g2lkysac34/
Behaviour
Program crash
Downloads MZ/PE file
GCleaner
Malware Config
C2 Extraction:
185.172.128.90
5.42.64.3
5.42.65.115
Unpacked files
SH256 hash:
c37679e78f6af5ba63dedfdfa3c66327626f6a4afa19359ca80d02ae5e1f827a
MD5 hash:
7757bf2b97b51df1bd3b15e17962675a
SHA1 hash:
8e436f717997057dff178f628e784d6e9bad7a51
Link:
https://www.unpac.me/results/7ad86afe-9628-41cc-aad2-bf32391d2a10/
SH256 hash:
ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a
MD5 hash:
6b29a6f6f98275a0e4df9db15c8170a8
SHA1 hash:
11c985eab5e756bb43b4d6f878091cfe96883459
Link:
https://www.unpac.me/results/7ad86afe-9628-41cc-aad2-bf32391d2a10/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe ba5b05faaf0926795951019e2091fe6fa85d27ce821734b9d5c7f7940d281c9a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/477912/
  
URLhaus
https://urlhaus.abuse.ch/url/2770950/
  
URLhaus
https://urlhaus.abuse.ch/url/2770896/
  
URLhaus
https://urlhaus.abuse.ch/url/2755634/

Comments


Avatar
zbet commented on 2024-02-27 06:18:01 UTC

url : hxxp://5.42.67.7/batushka/univ.exe