MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
SHA3-384 hash: 05141492423e6a9939504a0690614cb9e837e006749487d616d5e25a785682a281faae20d44c02d39bc73b4cf1692e9b
SHA1 hash: 049c0a18f94715e332861ac5065efcf1f393264a
MD5 hash: 3288ced938a5ddab4258b72494893094
humanhash: virginia-florida-london-gee
File name:Soft.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:5'136'672 bytes
First seen:2025-07-16 12:18:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 67d7979e0046e0f699eb340d4193ccc1 (3 x GCleaner)
ssdeep 98304:vSMywIrNKz+ETdUrlLS20NeG5JPFxSxhmm3wd:67lR6+ETdUBLOeG5JPFx6Yqy
TLSH T13436E09DFCA0A57BC3734779541B9E28D13E7978EDE99A8D17B828843EE0310252B05F
TrID 52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
16.8% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.5% (.EXE) OS/2 Executable (generic) (2029/13)
7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter aachum
Tags:exe gcleaner


Avatar
iamaachum
https://file-download.eu/Download.html => https://mega.nz/folder/aUFGSKYC#AHolx-tMktDozO_GO-61Lw

GCleaner C2: 176.46.157.48

Intelligence

File Origin
# of uploads :
1
# of downloads :
38
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Soft.exe
Verdict:
Malicious activity
Analysis date:
2025-07-16 12:20:52 UTC
Tags:
delphi gcleaner loader
Link:
https://app.any.run/tasks/5862f61c-6121-4481-8620-27b8ef1b8b89

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/14836/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=687798962f623871a5ef0762
Tags:
delphi emotet cobalt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process by context flags manipulation
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint invalid-signature keylogger obfuscated signed
Link:
https://www.filescan.io/uploads/687798948a7d628a81b237bd/reports/c9dd50f7-d859-4664-8bbc-180f24f6c2e6/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
Malware family:
RealVNC
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/eb776704-e406-4060-ac39-3f7335aef7fa
Result
Threat name:
CryptOne, GCleaner, GO Injector, LummaC
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1738036
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates / moves files in alternative data streams (ADS)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Potentially Suspicious Child Process Of Regsvr32
Sigma detected: Powershell launch regsvr32
Sigma detected: Rundll32 Execution Without CommandLine Parameters
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected GCleaner
Yara detected GO Injector
Yara detected LummaC Stealer
Yara detected Socks5Systemz
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1738036 Sample: Soft.exe Startdate: 16/07/2025 Architecture: WINDOWS Score: 100 121 185.156.73.98 RELDAS-NETRU Russian Federation 2->121 123 45.91.200.135 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Netherlands 2->123 125 15 other IPs or domains 2->125 155 Suricata IDS alerts for network traffic 2->155 157 Found malware configuration 2->157 159 Malicious sample detected (through community Yara rule) 2->159 161 18 other signatures 2->161 14 Soft.exe 2 2->14         started        18 regsvr32.exe 2->18         started        20 svchost.exe 8 2->20         started        22 svchost.exe 16 1 2->22         started        signatures3 process4 file5 115 C:\Users\user\AppData\...\svchost015.exe, PE32 14->115 dropped 117 C:\Users\user\AppData\Local\...\svcC3A0.tmp, PE32 14->117 dropped 165 Writes to foreign memory regions 14->165 167 Found hidden mapped module (file has been removed from disk) 14->167 169 Maps a DLL or memory area into another process 14->169 24 svchost015.exe 27 14->24         started        28 regsvr32.exe 18->28         started        31 WerFault.exe 2 20->31         started        signatures6 process7 dnsIp8 131 drive.usercontent.google.com 142.250.81.225, 443, 49687 GOOGLEUS United States 24->131 133 176.46.157.48, 49688, 49705, 80 ESTPAKEE Iran (ISLAMIC Republic Of) 24->133 85 C:\Users\user\AppData\...\JB1zRjwOb1r8.exe, PE32 24->85 dropped 87 C:\Users\user\AppData\...\28fCCCavtaGU.exe, PE32 24->87 dropped 89 C:\Users\user\AppData\...\62OxSLOx9.exe, PE32+ 24->89 dropped 91 3 other malicious files 24->91 dropped 33 28fCCCavtaGU.exe 2 24->33         started        37 JB1zRjwOb1r8.exe 24->37         started        39 62OxSLOx9.exe 24->39         started        163 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 28->163 file9 signatures10 process11 file12 75 C:\Users\user\AppData\...\28fCCCavtaGU.tmp, PE32 33->75 dropped 145 Multi AV Scanner detection for dropped file 33->145 41 28fCCCavtaGU.tmp 18 19 33->41         started        77 C:\Users\user\AppData\...\JB1zRjwOb1r8.tmp, PE32 37->77 dropped 44 JB1zRjwOb1r8.tmp 37->44         started        147 Contains functionality to inject code into remote processes 39->147 149 Writes to foreign memory regions 39->149 151 Injects a PE file into a foreign processes 39->151 46 rundll32.exe 39->46         started        50 WerFault.exe 19 16 39->50         started        signatures13 process14 dnsIp15 93 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 41->93 dropped 95 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 41->95 dropped 97 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 41->97 dropped 105 21 other malicious files 41->105 dropped 52 quickexplorerlib.exe 1 19 41->52         started        99 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 44->99 dropped 101 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 44->101 dropped 103 C:\Users\user\AppData\Local\...\_RegDLL.tmp, PE32 44->103 dropped 56 JB1zRjwOb1r8.exe 44->56         started        141 t.me 149.154.167.99, 443, 49689 TELEGRAMRU United Kingdom 46->141 143 daruubs.top 167.160.161.12, 443, 49690, 49696 ASN-QUADRANET-GLOBALUS United States 46->143 171 System process connects to network (likely due to code injection or exploit) 46->171 173 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 46->173 175 Found many strings related to Crypto-Wallets (likely being stolen) 46->175 177 3 other signatures 46->177 file16 signatures17 process18 dnsIp19 127 66.63.187.153, 443, 50372, 50409 ASN-QUADRANET-GLOBALUS United States 52->127 129 193.176.153.180, 2024, 50438, 50554 AGROSVITUA unknown 52->129 79 C:\ProgramData\QuickExplorerLib\sqlite3.dll, PE32 52->79 dropped 81 C:\ProgramData\...\QuickExplorerLib.exe, PE32 52->81 dropped 83 C:\Users\user\AppData\...\JB1zRjwOb1r8.tmp, PE32 56->83 dropped 58 JB1zRjwOb1r8.tmp 56->58         started        file20 process21 file22 107 C:\Users\user\AppData\Local\is-VN4F3.tmp, PE32 58->107 dropped 109 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 58->109 dropped 111 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 58->111 dropped 113 2 other malicious files 58->113 dropped 61 regsvr32.exe 58->61         started        process23 dnsIp24 135 253.150.96.191.bl.spamcop.net 61->135 137 mta7.am0.yahoodns.net 61->137 139 11 other IPs or domains 61->139 119 C:\Users\user:.repos, data 61->119 dropped 179 System process connects to network (likely due to code injection or exploit) 61->179 181 Suspicious powershell command line found 61->181 183 Creates / moves files in alternative data streams (ADS) 61->183 185 Found strings related to Crypto-Mining 61->185 66 powershell.exe 61->66         started        69 powershell.exe 61->69         started        file25 signatures26 process27 signatures28 153 Loading BitLocker PowerShell Module 66->153 71 conhost.exe 66->71         started        73 conhost.exe 69->73         started        process29
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/3288ced938a5ddab4258b72494893094
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3/
Threat name:
Win32.Spyware.Lummastealer
Create hunting rule
Status:
Suspicious
First seen:
2025-07-16 12:18:28 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
22 of 38 (57.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3vyx7s35qrnexn7ahafj35tfegnzwlpctsukcjqayuxygedj6gzq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250716-pgssjatmt3/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/db77dd9c-0d99-4c31-9044-8be2ffd74d2f
Unpacked files
SH256 hash:
dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
MD5 hash:
3288ced938a5ddab4258b72494893094
SHA1 hash:
049c0a18f94715e332861ac5065efcf1f393264a
Link:
https://www.unpac.me/results/9bd960bf-9f94-4098-b668-a71e1770feab/
SH256 hash:
5a5ed78e04c7ad144a4580c19e9743d252b4a25e84ba7e6c4c43fc459c956a9a
MD5 hash:
8aadb7e2a4e0128b357b6e90d924d128
SHA1 hash:
cfc4678d82f0e4b0cebd1fb0b01f479dc25134d5
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/9bd960bf-9f94-4098-b668-a71e1770feab/
Parent samples :
2046f265e025776e7199a9e576be5ed49483841f5203c3e3eeb79d0a24f73920
384cdb291c4006761018b84c0c02f37afbfa0b51c6bf0220639abc91f74009b1
768f9ecc19a84b15234ead8058f24a9c8a337430312eab9ecbbcbfa8ab69d0f3
aba7585008a92523b09b28c94fdd8fb7afc39b5b466efac8ca5f7f2b520bbedd
ca4a5fcd9eff405f9f8037e89e1a72914eda7129e5aa9476283021c03c56500c
c5e135c050b4ecbc73acae15b6dbbfaf5157e60fe62c96913b4c56df77ae4feb
dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3
c582323df2a900ae3b0b1860ff768aa5e90f3e595b33aecb57040b130a65e632
e65f22bbb7a32f6fd436eb0ea6de0c000542ffd6785a983d8f0594b791331994
70cc21383260ea0cb520627324853ae7665cb4b8f6462c5a96e07375a2c26317
3c4cd60b0bcf381bfdeae2397ae2011016d1d389df0cb524d5e12ac9aea5e71b
408ef63acd027f6ba843e30d00d51e506d714804ee842a83f4f31a4b5d7aa7d9
f62ad9ecb4facb02dead75e27e29db58519b6805f49278852d02298b55e59cf5
758e36455c17152210a6ae8001e3b9d7680159440e0e6ae702b9302ec2160d50
a91a863821ef21472adfeeed5e90eebf3fe5e559f257f7d37de401c2a0553485
8b2d9358a329089c3bd96cce97b91e9b8a4d900abd0aaa8e55c3c0466e930c88
9653fb267376aa1495996d935a8bb8b6d73b46aa372d814bfb3c91ba0ebbf7f3
e41b1aa6ff791b7611638851db2ba42c47a125a81b5c74d10354f4f87d4e8770
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
05664da4d3ea8b39b6183a1112e67f46a8715536faa0a9469bc2659f4ef16289
d3a77d8bcd9963d30fd3e51acee6654e3ccbf2b2b81fbe47e97b9b9068c76f06
1a757566caa5edd32fd5c190b9e8da7d7abf3398b9a3ceddd365a95886434767
53afe13ca6d157bec8b1cc467764abd1194fb3bbd06c0a67a2ee5f560b63d1a4
82bf3e8991a22f67e5cf9b7340eb3c1fa5456c9d9a9e27fdc107c46572713897
512b629f01ce1668bcc60ea305e93fb264cf2b7f2f87bb3aafef29beeb604cce
cc261502042db67adb917ce03321ee47277cfbc1712b770c6b71c035b89793cb
477df2a52197bd71524c4ccf192ce2d2afb8b4b3d8e33f8efa418910342f30e7
a53952ad1b88e5d6b4fc14f09e4ccd0f2ce4be72df7c5693abd8cdad953a4871
5dfcdc1c491fbf2f7f2fbac6bbf27b84be652583b66b252c46e8ed86577c3c60
SH256 hash:
0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c
MD5 hash:
4ce3ce196eda86d92b68362b6269b618
SHA1 hash:
fd42ee0aca0315acac25c297f1ce33634c549559
Link:
https://www.unpac.me/results/9bd960bf-9f94-4098-b668-a71e1770feab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe dd717fcb7d845a4bb7e0380a9df665219b9b2de29ca8a12600c52f831069f1b3

(this sample)

  
Link
https://tria.ge/250716-pelanshl5s/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/14836/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments