MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 15


Intelligence 15 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92
SHA3-384 hash: 2186f40f2e56dd5f1585c4f3dbee9c81c16cc7a9dc0eabfc5b0e4977e884f16f0bc57ea24f4beb038cf703a841b7d7d7
SHA1 hash: 2450eeb9a26c91f3d5abe18b68e105df72f949b1
MD5 hash: 339a7eb6c2bf6a4b48f5c20a3ef82864
humanhash: july-cup-minnesota-twelve
File name:setup_euone.bin
Download: download sample
Signature GCleaner
Create hunting rule
File size:765'712 bytes
First seen:2026-07-04 15:20:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7916d8d86ecdc561619d308cf2ace8e9 (2 x GCleaner)
ssdeep 12288:qGkWSfphm99vVPApwpC5nJ4n59WSMFVWEWw6D31tV+EpP4W:GrpcxAyGk6HbWTD3Ig
TLSH T156F49E22B1E44573D1771A3C8D7BB678982BBD212E289C4A7BE42C4C4E3BE4175253B7
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (573 x Quakbot, 302 x GCleaner, 137 x ArkeiStealer)
Reporter aachum
Tags:dropped-by-OffLoader EUONE exe gcleaner


Avatar
iamaachum
http://158.94.209.95/setup?name=euone

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
setup_euone.bin.exe
Verdict:
Malicious activity
Analysis date:
2026-07-04 15:23:49 UTC
Tags:
gcleaner loader
Link:
https://app.any.run/tasks/7969508a-388b-4716-abcf-03cf3f15fd1b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72859/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader49.52185.27941.25697.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4924f4762b0b26f3cfbe7d
Tags:
cobalt delphi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Deleting a recently created file
Connection attempt to an infection source
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi expired-cert fingerprint installer-heuristic invalid-signature keylogger masquerade packed signed
Link:
https://www.filescan.io/uploads/6a4924e065193245b2cabcbb/reports/ea0baca0-55db-4cbd-90e2-e0b8f392e61c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-10T08:57:00Z UTC
Last seen:
2026-07-04T13:51:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Win32.Evilch.gen
Link:
https://opentip.kaspersky.com/c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1d3967b7-608e-4be0-b4a6-37539abbb736
Result
Threat name:
CryptOne, GCleaner, Tofsee, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1937466
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Creates / moves files in alternative data streams (ADS)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Found strings related to Crypto-Mining
Hijacks the control flow in another process
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1937466 Sample: setup_euone.bin.exe Startdate: 04/07/2026 Architecture: WINDOWS Score: 100 82 45.91.200.135 PODAONLV Netherlands 2->82 84 185.156.73.98 FDN3UA Netherlands 2->84 86 12 other IPs or domains 2->86 98 Suricata IDS alerts for network traffic 2->98 100 Found malware configuration 2->100 102 Malicious sample detected (through community Yara rule) 2->102 104 12 other signatures 2->104 12 setup_euone.bin.exe 2->12         started        15 GDFwAdmin.exe 2->15         started        17 GDFwAdmin.exe 2->17         started        signatures3 process4 signatures5 122 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 12->122 124 Hijacks the control flow in another process 12->124 126 Contains functionality to inject code into remote processes 12->126 130 4 other signatures 12->130 19 svchost.exe 36 12->19         started        128 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 15->128 process6 dnsIp7 88 158.94.209.95, 49709, 49710, 49714 OMEGATECH-ASSC Netherlands 19->88 90 drive.usercontent.google.com 142.251.214.97, 443, 49708 GOOGLE-GoogleLLCUS United States 19->90 68 C:\Users\user\AppData\...68sb9kKAUl.exe, PE32+ 19->68 dropped 70 C:\Users\user\AppData\...\sU3fAeAuQRb9V.exe, PE32+ 19->70 dropped 72 C:\Users\user\AppData\...behaviorgraphhF6c2zxfoUE.exe, PE32+ 19->72 dropped 74 5 other malicious files 19->74 dropped 106 System process connects to network (likely due to code injection or exploit) 19->106 108 Unusual module load detection (module proxying) 19->108 24 DKMLm8SUYPtvV.exe 2 19->24         started        28 Nsb9kKAUl.exe 1 19->28         started        30 sU3fAeAuQRb9V.exe 1 19->30         started        32 3 other processes 19->32 file8 signatures9 process10 file11 78 C:\Users\user\AppData\...\DKMLm8SUYPtvV.tmp, PE32 24->78 dropped 118 Antivirus detection for dropped file 24->118 120 Multi AV Scanner detection for dropped file 24->120 34 DKMLm8SUYPtvV.tmp 3 4 24->34         started        37 conhost.exe 28->37         started        39 conhost.exe 30->39         started        41 conhost.exe 32->41         started        43 conhost.exe 32->43         started        45 conhost.exe 32->45         started        signatures12 process13 file14 58 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 34->58 dropped 47 DKMLm8SUYPtvV.exe 2 34->47         started        process15 file16 80 C:\Users\user\AppData\...\DKMLm8SUYPtvV.tmp, PE32 47->80 dropped 50 DKMLm8SUYPtvV.tmp 5 12 47->50         started        process17 file18 60 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 50->60 dropped 62 C:\ProgramData\...\is-PENCIX022C.tmp, PE32 50->62 dropped 64 C:\ProgramData\...\is-HHW2WZZFYS.tmp, PE32 50->64 dropped 66 4 other malicious files 50->66 dropped 53 GDFwAdmin.exe 2 1 50->53         started        process19 dnsIp20 92 quag.cn 2.26.248.34, 443, 49719 NUXT-ASGB Germany 53->92 94 27.145.129.102.bl.spamcop.net 53->94 96 13 other IPs or domains 53->96 76 C:\Users\user:.repos, data 53->76 dropped 110 Creates / moves files in alternative data streams (ADS) 53->110 112 Found strings related to Crypto-Mining 53->112 114 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 53->114 116 Unusual module load detection (module proxying) 53->116 file21 signatures22
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/339a7eb6c2bf6a4b48f5c20a3ef82864
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92/
Verdict:
Malicious
Threat:
Family.GCLEANER
Link:
https://tip.neiki.dev/file/c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2026-06-10 10:26:00 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zdyis3rifkcdjwje3xitx3bmeqazqlwsbs4fybrbf554iix5d2ja._file
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner discovery loader
Link:
https://tria.ge/reports/260704-sra71scy9n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Family: GCleaner
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
185.156.73.98
Unpacked files
SH256 hash:
c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92
MD5 hash:
339a7eb6c2bf6a4b48f5c20a3ef82864
SHA1 hash:
2450eeb9a26c91f3d5abe18b68e105df72f949b1
Link:
https://www.unpac.me/results/da7ab62f-967a-465d-a099-5420bfcf1c29/
SH256 hash:
9dd93b4839b0137e09f5433a31ebb7028badcc451431af572c374dd2899326e3
MD5 hash:
8494dfc3f1d1beccf735342d1df61f85
SHA1 hash:
b345f12f1d77cb6521e1b97128ea203ff6c2bd73
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/da7ab62f-967a-465d-a099-5420bfcf1c29/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c8f0896e282a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c8f0896e282a8434d924ddd13bec2c2401982ed20cb85c06212f7bc422fd1e92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/72859/

Comments