🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 13


Intelligence 13 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096
SHA3-384 hash: f86db0627f8cf2a71aab8d9bc84ecf14223d8b652407cbbfbc18168631a77db3f89bdfc69dfc6ce078afdda82e0e4f41
SHA1 hash: 668dd8566eacd7b89dab013b36cccf0f94be8c4a
MD5 hash: 55d635733571cf404f3af64646dc97e9
humanhash: bakerloo-ten-india-wisconsin
File name:file.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:669'456 bytes
First seen:2026-09-24 13:25:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cbfcec59e4a5b111f28e442b8b24e1eb (2 x GCleaner)
ssdeep 12288:ajZZtKGfanz1BulNam0SSiR1hVCSHFe0IebzYssoqY54GlI:g5R0PuHhzHCYbIgs5Y54L
TLSH T14CE49F26A1A0C437D2623BFB8D5B92B898F6FD103D2958897EE45D4C1F3B2817576383
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (573 x Quakbot, 322 x GCleaner, 137 x ArkeiStealer)
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-24 15:16:54 UTC
Tags:
gcleaner loader auto generic
Link:
https://app.any.run/tasks/55275a15-5a25-43c5-9559-afd4e511672f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/88800/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Launching a service
Deleting a recently created file
Connection attempt to an infection source
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 borland_delphi evasive expired-cert fingerprint installer-heuristic invalid-signature keylogger packed signed
Link:
https://www.filescan.io/uploads/6ab524f5a2bc1d09e1f5f4a9/reports/57288d35-f9eb-47ac-99fd-53f607df102e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-24T09:14:00Z UTC
Last seen:
2026-09-26T09:15:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2b8dc86b-3a18-4954-8923-f1567dcd26a6
Result
Threat name:
Amadey, CryptOne, GCleaner, REMUS Steale
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1977689
Signature
Adds a directory exclusion to Windows Defender
AI detected malicious Powershell script
AI detected suspicious PE / MSI digital signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hijacks the control flow in another process
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Powershell creates an autostart link
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell create lnk in startup
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious access to claude desktop data directory by non-Claude process
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sleep reduction / modifications
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected CryptOne packer
Yara detected defendnot Loader
Yara detected GCleaner
Yara detected REMUS Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1977689 Sample: file.exe Startdate: 24/09/2026 Architecture: WINDOWS Score: 100 150 45.91.200.135 PODAONLV Netherlands 2->150 152 185.156.73.98 FDN3UA Netherlands 2->152 154 6 other IPs or domains 2->154 180 Suricata IDS alerts for network traffic 2->180 182 Found malware configuration 2->182 184 Malicious sample detected (through community Yara rule) 2->184 186 21 other signatures 2->186 12 file.exe 2->12         started        15 defendnot-loader.exe 2->15         started        17 msiexec.exe 2->17         started        20 AdvDefragConsole.exe 2->20         started        signatures3 process4 dnsIp5 240 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 12->240 242 Hijacks the control flow in another process 12->242 244 Contains functionality to inject code into remote processes 12->244 256 2 other signatures 12->256 23 svchost.exe 49 12->23         started        246 Writes to foreign memory regions 15->246 248 Allocates memory in foreign processes 15->248 250 Creates a thread in another existing process (thread injection) 15->250 28 Taskmgr.exe 15->28         started        98 C:\Windows\Installer\MSIDF7E.tmp, PE32 17->98 dropped 100 C:\...\fleetdeck_agent_svc.exe, PE32 17->100 dropped 30 fleetdeck_agent_svc.exe 17->30         started        32 msiexec.exe 17->32         started        164 94.26.38.30 OMEGATECH-ASSC Netherlands 20->164 252 Multi AV Scanner detection for dropped file 20->252 254 Unusual module load detection (module proxying) 20->254 file6 signatures7 process8 dnsIp9 166 91.92.242.236, 49754, 80 OMEGATECH-ASSC Netherlands 23->166 168 drive.usercontent.google.com 142.250.191.1, 443, 49750 GOOGLE-GoogleLLCUS United States 23->168 112 C:\Users\user\AppData\...\wdPk4QyvZ.exe, PE32+ 23->112 dropped 114 C:\Users\user\AppData\...\6uPR5sQQXQmp.exe, PE32+ 23->114 dropped 116 C:\Users\user\AppData\...\3ZfGUjn1tnRUo.exe, PE32+ 23->116 dropped 118 15 other malicious files 23->118 dropped 234 System process connects to network (likely due to code injection or exploit) 23->234 236 Unusual module load detection (module proxying) 23->236 34 QWqljroTQX7e.exe 2 23->34         started        38 uPUatgMkFSa.exe 23->38         started        40 RgRNuPckj.exe 2 23->40         started        44 11 other processes 23->44 238 Suspicious powershell command line found 30->238 42 powershell.exe 30->42         started        file10 signatures11 process12 dnsIp13 104 C:\Users\user\AppData\...\QWqljroTQX7e.tmp, PE32 34->104 dropped 188 Multi AV Scanner detection for dropped file 34->188 47 QWqljroTQX7e.tmp 18 26 34->47         started        190 Injects code into the Windows Explorer (explorer.exe) 38->190 192 Writes to foreign memory regions 38->192 194 Allocates memory in foreign processes 38->194 206 2 other signatures 38->206 50 explorer.exe 38->50 injected 196 Suspicious powershell command line found 40->196 198 Adds a directory exclusion to Windows Defender 40->198 54 RgRNuPckj.exe 40->54         started        56 conhost.exe 40->56         started        58 conhost.exe 42->58         started        170 ip-api.com 208.95.112.1 TUT-AS-TotalUptimeTechnologiesLLCUS United States 44->170 172 nailgalleryapp.com 196.41.127.31 CybersmartZA South Africa 44->172 174 3 other IPs or domains 44->174 106 C:\Users\user\AppData\...\Hl0iKKdMFw.tmp, PE32 44->106 dropped 108 C:\Users\user\...\25BFBBA00FD79F17.exe, PE32+ 44->108 dropped 110 C:\Users\user\AppData\...\6uPR5sQQXQmp.exe, PE32+ 44->110 dropped 200 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 44->200 202 Tries to steal Mail credentials (via file / registry access) 44->202 204 Found many strings related to Crypto-Wallets (likely being stolen) 44->204 208 8 other signatures 44->208 60 Hl0iKKdMFw.tmp 44->60         started        62 conhost.exe 44->62         started        file14 signatures15 process16 dnsIp17 120 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 47->120 dropped 122 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 47->122 dropped 124 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 47->124 dropped 134 21 other malicious files 47->134 dropped 64 AdvDefragConsole.exe 25 47->64         started        156 ksakdakd1k.club 172.67.158.137 CLOUDFLARENET-CloudflareIncUS Canada 50->156 210 System process connects to network (likely due to code injection or exploit) 50->210 212 Tries to steal Instant Messenger accounts or passwords 50->212 214 Tries to steal Mail credentials (via file / registry access) 50->214 222 5 other signatures 50->222 68 chrome.exe 50->68         started        126 C:\Windows\lq0CRFNh\defendnot.dll, PE32+ 54->126 dropped 128 C:\Windows\lq0CRFNh\defendnot-loader.exe, PE32+ 54->128 dropped 136 2 other malicious files 54->136 dropped 216 Suspicious powershell command line found 54->216 218 Drops executables to the windows directory (C:\Windows) and starts them 54->218 220 Adds a directory exclusion to Windows Defender 54->220 70 defendnot-loader.exe 54->70         started        73 powershell.exe 54->73         started        75 powershell.exe 54->75         started        77 2 other processes 54->77 130 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 60->130 dropped 132 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 60->132 dropped file18 signatures19 process20 dnsIp21 142 94.26.38.17 OMEGATECH-ASSC Netherlands 64->142 144 196.251.121.77 Hero-TelecomsZA Germany 64->144 146 64.89.160.142 GHOSTYNETWORKSUS Luxembourg 64->146 102 C:\ProgramData\...\AdvDefragConsole.exe, PE32 64->102 dropped 79 powershell.exe 17 64->79         started        148 192.168.2.5, 443, 49750, 49751 unknown unknown 68->148 83 chrome.exe 68->83         started        224 Multi AV Scanner detection for dropped file 70->224 226 Writes to foreign memory regions 70->226 228 Allocates memory in foreign processes 70->228 230 Creates a thread in another existing process (thread injection) 70->230 86 Taskmgr.exe 70->86         started        232 Loading BitLocker PowerShell Module 73->232 88 conhost.exe 73->88         started        90 conhost.exe 75->90         started        92 conhost.exe 77->92         started        94 Conhost.exe 77->94         started        file22 signatures23 process24 dnsIp25 138 C:\Users\user\...\fAdvDefragConsole32.lnk, MS 79->138 dropped 176 Found many strings related to Crypto-Wallets (likely being stolen) 79->176 178 Powershell creates an autostart link 79->178 96 conhost.exe 79->96         started        158 www.google.com 142.251.154.119 GOOGLE-GoogleLLCUS United States 83->158 160 mobile-gtalk.l.google.com 142.251.167.188 GOOGLE-GoogleLLCUS United States 83->160 162 4 other IPs or domains 83->162 140 Chrome Cache Entry: 362, PDP-11 83->140 dropped file26 signatures27 process28
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/55d635733571cf404f3af64646dc97e9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096/
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-09-24 13:26:15 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zy6rn4n4wmmrgwuzwegu3krknagczlnnxdmaqkzz2nuww4aw4cla._file
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner defense_evasion discovery loader privilege_escalation
Link:
https://tria.ge/reports/260924-qptkgaee28/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Downloads MZ/PE file
Family: GCleaner
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
185.156.73.98
45.91.200.135
Unpacked files
SH256 hash:
ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096
MD5 hash:
55d635733571cf404f3af64646dc97e9
SHA1 hash:
668dd8566eacd7b89dab013b36cccf0f94be8c4a
Link:
https://www.unpac.me/results/b439a1be-6b09-4bee-b943-53ed4e857216/
SH256 hash:
37873e66ca0e19bdc739b11a1b7a345f1b84b2d31b0a83fcbc39e80674268da7
MD5 hash:
6e25c6ca168545a4d824c9d14e8c3cb4
SHA1 hash:
9b8960d7f1daad8b13374737d092a4ca90e2b195
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/b439a1be-6b09-4bee-b943-53ed4e857216/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ce3d16f1bcb3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3913054/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/88800/

Comments