MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989
SHA3-384 hash: a70ef2cfe913b4e655bef412cb3ea54a44129cb09d78e2d6125951df95a54dbf3ba38caf605c51ff21670718e3e4aa2d
SHA1 hash: fe1b3ebe150c6eeba997cb6d00cba91afe50c075
MD5 hash: c403333de741e184676165718fcf7111
humanhash: speaker-social-fifteen-papa
File name:c403333de741e184676165718fcf7111.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:361'984 bytes
First seen:2023-03-26 16:32:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 59edcf4038e73a659a2ff6e04ad467ac (4 x Smoke Loader, 1 x GCleaner, 1 x Amadey)
ssdeep 6144:mk297oIiDDagb4XCpEHMnc6C65z6Gr5W/iNN4T:X297viDGgb4X7HcVX5z6Gr5dN
TLSH T18474AE3252F06820F662EB328E2BC7FC2A6FB9619E157B7E17555A7F09702A1C131335
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon a8dafcf0f0f0f0e4 (1 x GCleaner)
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c403333de741e184676165718fcf7111.exe
Verdict:
Malicious activity
Analysis date:
2023-03-26 16:39:40 UTC
Tags:
gcleaner
Link:
https://app.any.run/tasks/e79f1435-03e2-43fe-9958-db84eebb3335

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Create hunting rule
Link:
https://www.capesandbox.com/analysis/377566/
Detection(s):
Win.Ransomware.Tofsee-9994394-0
Create hunting rule

Win.Ransomware.Tofsee-9994395-0
Create hunting rule

Win.Packed.Tofsee-9994518-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/642073bf9c109cf74b2fd4e5/reports/2875d20f-6dfc-40c8-ba8b-b6a1652b789e/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/978e5f8b-c333-416c-accf-f1ebaa634771
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1202182
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Nymaim
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2023-03-26 16:33:06 UTC
File Type:
PE (Exe)
Extracted files:
41
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2bp2uowmv7ixzgl7svcbfkdbecchp466wsta5akuxctvvkwalgeq._file
Verdict:
malicious
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner loader
Link:
https://tria.ge/reports/230326-t2hwaahb92/
Behaviour
Program crash
Downloads MZ/PE file
GCleaner
Malware Config
C2 Extraction:
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Unpacked files
SH256 hash:
55e4263ddee515828bedf79c88a418a17f837e82de4eaa576e1b4d2fecfcd2b6
MD5 hash:
8f45fea917115d428af4646a2cb0c36f
SHA1 hash:
a19304303a72bcccf8e0d542d6096e3d6245344d
Detections:
Nymaim
Create hunting rule
win_nymaim_g0
Create hunting rule
win_gcleaner_w0
Create hunting rule
win_gcleaner_auto
Create hunting rule
Link:
https://www.unpac.me/results/591dc042-0db0-4a1e-bd1e-513a0e3d8fb6/
SH256 hash:
d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989
MD5 hash:
c403333de741e184676165718fcf7111
SHA1 hash:
fe1b3ebe150c6eeba997cb6d00cba91afe50c075
Link:
https://www.unpac.me/results/591dc042-0db0-4a1e-bd1e-513a0e3d8fb6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/377566/

Comments