MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 dd7256ae55124fa928ab7ca5d6de64cebe3b3e04d09f91d98b1a0444c4c0d05a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GCleaner
Vendor detections: 12
| SHA256 hash: | dd7256ae55124fa928ab7ca5d6de64cebe3b3e04d09f91d98b1a0444c4c0d05a |
|---|---|
| SHA3-384 hash: | 2cb7b1643eb4ccb76e449d52f4fc1e1f43115e213e05f556262578e32c70dfd249b9fad34c561e12a4818aa66e55586c |
| SHA1 hash: | b9470cb0689c856d64748d86011b38c504db4fad |
| MD5 hash: | 32920e12f4e627be72ef555c41058ccd |
| humanhash: | winner-wisconsin-red-hotel |
| File name: | dd7256ae55124fa928ab7ca5d6de64cebe3b3e04d09f91d98b1a0444c4c0d05a |
| Download: | download sample |
| Signature | GCleaner |
| File size: | 1'312'091 bytes |
| First seen: | 2022-12-07 11:56:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'503 x Socks5Systemz, 262 x RaccoonStealer) |
| ssdeep | 24576:a2excpH5aYOSP4IcG/dEFT0WuI2lbg65UEwv7Vj7mUEHM6a723:a2WcpHApDIcG/OV+I4bg65UdVfQst23 |
| TLSH | T1A255230FB9B3E132D0E1DCB51F2788D115436D6BEAB86C1EA78CB1A45EF7115B60E602 |
| TrID | 50.3% (.EXE) Win32 Executable PowerBASIC/Win 9.x (148303/79/28) 37.2% (.EXE) Inno Setup installer (109740/4/30) 4.8% (.EXE) Win32 Executable Delphi generic (14182/79/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | b28cf8e0e88dac92 (4 x GCleaner, 1 x CryptBot) |
| Reporter |  adrian__luca |
| Tags: | exe gcleaner |
Intelligence
File Origin
# of uploads :
1
# of downloads :
169
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dd7256ae55124fa928ab7ca5d6de64cebe3b3e04d09f91d98b1a0444c4c0d05a
Verdict:
Malicious activity
Analysis date:
2022-12-07 11:55:20 UTC
Tags:
installer opendir loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Modifying a system file
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the Windows subdirectories
Launching a process
Launching a tool to kill processes
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Nymaim
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Nymaim
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Tepfer
Status:
Malicious
First seen:
2022-11-27 07:19:35 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
15 of 26 (57.69%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
16c51e4e1a2590f9fd561b6fd37b540f465fe0165162ecb02313231abedcb190
MD5 hash:
efa770464cf806ded614d3c29438337f
SHA1 hash:
ae9c1a110b2fbb5e65973447ddebf1fc42c6c2b5
Detections:
win_nymaim_g0
Nymaim
win_gcleaner_auto
SH256 hash:
bad0e4e8be7f0a24834b08a6e45597fbab904670b54a821ee57b26ac3e06b53a
MD5 hash:
ff639588b12c1c154097969d907b318b
SHA1 hash:
6fd6c0e1be8c0896a14516a372b729b8373ff2e2
SH256 hash:
753083de10b230da03c6e2bc4865bbefb9a9c94d8946699d3a6d903048f0ba94
MD5 hash:
fc245721f161c38115ecec21ef18971b
SHA1 hash:
0d7652a91c74b7861948293dfd80f1d7831a73fb
SH256 hash:
dd7256ae55124fa928ab7ca5d6de64cebe3b3e04d09f91d98b1a0444c4c0d05a
MD5 hash:
32920e12f4e627be72ef555c41058ccd
SHA1 hash:
b9470cb0689c856d64748d86011b38c504db4fad
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.68
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.