MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eace9d6f2be6f377e9a834aed0f2c7b31252e911a65c482366b7a9cb9828d42a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eace9d6f2be6f377e9a834aed0f2c7b31252e911a65c482366b7a9cb9828d42a
SHA3-384 hash: f650b380323c47ff20b0e48d2453eed3b454be42a2b1fdcb0dc74e1cead83ce4da6e71c9f1f66cd7ce480afc361de870
SHA1 hash: 9b918a71a3c09ff5337ef6fca03e0bd57215785b
MD5 hash: 5467934eb31dc7a24c37350fb86c53f8
humanhash: november-mississippi-cold-yellow
File name:file
Download: download sample
Signature GCleaner
Create hunting rule
File size:348'672 bytes
First seen:2022-10-11 05:27:09 UTC
Last seen:2022-10-11 05:43:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f07757163332cdbf737bafdb4614222c (8 x Smoke Loader, 7 x GCleaner, 2 x ArkeiStealer)
ssdeep 6144:1hw3RLBDbjUwXZJhyogJX8M12aQlMSYPppsuMXnh4:1hw3RNbjU4iogJX8naOMrkZq
Threatray 1'425 similar samples on MalwareBazaar
TLSH T17774F10339C0C871EA6A61358D75D6746BFBBC7506368A877BE812AC4F657D29E30383
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b8f0f4e4e4e4f88b (1 x GCleaner)
Reporter andretavare5
Tags:exe gcleaner


Avatar
andretavare5
Sample downloaded from http://95.214.24.96/load.php?pub=mixinte

Intelligence

File Origin
# of uploads :
8
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318752/
Detection(s):
Win.Packed.Dropperx-9973281-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Creating a file in the system32 subdirectories
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/6344fee281eef2a234c4c4e7/reports/54acea70-377f-4092-aafb-6d192e6f58b7/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b783c17-8c80-4591-990f-2d2189255bb5
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1087651
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected Nymaim
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eace9d6f2be6f377e9a834aed0f2c7b31252e911a65c482366b7a9cb9828d42a/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-11 05:28:07 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5lhj23zl43zxp2nigsxnb4whwmjff2iruzoeqi3gw6u4xgbi2qva._file
Verdict:
malicious
Similar samples:
263ba408f31fea50114cf2564e43fa5149f5d2da732012830a3f05b3c5c64d37
GCleaner
2a976d8cf92d113e8c56dd9a3db304d0b3c193373139de3f05627f6e0bb100a6
GCleaner
441b9eee712b85616ca62d08810f6d4a232c2307811c211354be18c3f3ef90d4
GCleaner
6f959997fd2a9b93f18088188cae26410b5041713449349b7ddacb806a41f8b7
GCleaner
74b17d15bae61dd6971a1917c534c5a30fabe0121d2b58c9bcfd8ba54aee4a17
GCleaner
9dd0ea1fbd0d1c61a4c1ddf0cc122bd06cce3ce18ef722409a78e59b2efd2b48
GCleaner
b000347178c5645b8691fe97b3fab986fbac71012f2645898b7d6b315df41fea
GCleaner
d96df3244bdc08ecb9a1630e8d8a68b791b880c07475b5e755024bf515d58f55
GCleaner
de84d2092f008362d2f36f8f31fc28fb506c2f0ebe53d41ea30efbd4f4f218c1
GCleaner
f305b8b905edd96dc7fa0c45767ab4a913e413f9233313278a1e9f2e61f005d3
GCleaner
+ 1'415 additional samples on MalwareBazaar
Result
Malware family:
nymaim
Create hunting rule
Score:
  10/10
Tags:
family:nymaim trojan
Link:
https://tria.ge/reports/221011-f5z23sgefk/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Program crash
NyMaim
Malware Config
C2 Extraction:
208.67.104.97
85.31.46.167
Gathering data
Unpacked files
SH256 hash:
bdf886cafed6ed92f6940769a488aedcf751c5fd3e3f4fbb51b0620e39d6726b
MD5 hash:
e72cf1f71443c6b6e560b479ed960b59
SHA1 hash:
d83b2a4891ef38e0e9fe28e561725ae86ae415fc
Detections:
win_nymaim_g0
Create hunting rule
win_gcleaner_auto
Create hunting rule
Link:
https://www.unpac.me/results/5a5f7ef4-52b4-491f-a3ea-66c167e0e063/
Parent samples :
1817d71d6d75cb18ab4a1ad6e0d538a4c0711131818f8fdec36b40138cb257fe
9f7424e2f72c7d9e1fad08812334f72c193dd966951af01731998fa0da80e386
05b3de466abc996a878bbf1199e70f9ef8a36a7069ba838ff451b3c5fe05f18f
40ff4949854e9668207abbae374cc429001191a3980707a49bae807a3b3066b5
1c4ca1748b10b4caa13f3a9fdeb3b9f8728590d170adc2a5937b3eb92ecf48aa
88d59a3629e21d66fb7cd48f4d5542a4ff4205fb92834ded6244b6f243019390
56cb61aafd4e0f7255541c0b89649f8b1616490dd016e9efdab4423cfcce9a87
6a4c00312d056399452a15ab601461eda668625cc0f2ddc643fb414e283f591f
f305b8b905edd96dc7fa0c45767ab4a913e413f9233313278a1e9f2e61f005d3
d96df3244bdc08ecb9a1630e8d8a68b791b880c07475b5e755024bf515d58f55
b000347178c5645b8691fe97b3fab986fbac71012f2645898b7d6b315df41fea
9dd0ea1fbd0d1c61a4c1ddf0cc122bd06cce3ce18ef722409a78e59b2efd2b48
263ba408f31fea50114cf2564e43fa5149f5d2da732012830a3f05b3c5c64d37
2a976d8cf92d113e8c56dd9a3db304d0b3c193373139de3f05627f6e0bb100a6
6f959997fd2a9b93f18088188cae26410b5041713449349b7ddacb806a41f8b7
441b9eee712b85616ca62d08810f6d4a232c2307811c211354be18c3f3ef90d4
74b17d15bae61dd6971a1917c534c5a30fabe0121d2b58c9bcfd8ba54aee4a17
de84d2092f008362d2f36f8f31fc28fb506c2f0ebe53d41ea30efbd4f4f218c1
eace9d6f2be6f377e9a834aed0f2c7b31252e911a65c482366b7a9cb9828d42a
a34cd84ab3edd0b697e20905af0cb8c67a2bb6ef58477a16327a23c3ff203295
1fb998c5bd768cddd4b48eef261039e074fbaac2a459fb76742e7d3cf8e6eb31
5f9a01202ab0db3309e8285d83252cef4b81b9cd832a9785a18098761d97f427
56e180a89542f119e9a1ea6b1822651e2e35bab9fc23c1f045f988af67c5887f
SH256 hash:
eace9d6f2be6f377e9a834aed0f2c7b31252e911a65c482366b7a9cb9828d42a
MD5 hash:
5467934eb31dc7a24c37350fb86c53f8
SHA1 hash:
9b918a71a3c09ff5337ef6fca03e0bd57215785b
Link:
https://www.unpac.me/results/5a5f7ef4-52b4-491f-a3ea-66c167e0e063/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eace9d6f2be6f377e9a834aed0f2c7b31252e911a65c482366b7a9cb9828d42a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:win_gcleaner_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.gcleaner.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/318752/
  
URLhaus
https://urlhaus.abuse.ch/url/2276314/

Comments