MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 11


Intelligence 11 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972
SHA3-384 hash: b3964ece60d5a3e7c0f8d5b5f24f2b0cbaa7db0c225423bd40e24d44bc210ed861605f8cddbf90a4a96c51a6ab887e7f
SHA1 hash: 1deb6a1c66642a3aacd6c495e30b3d406351c30a
MD5 hash: 9d2ea2d20846371ec4c97552bb0ad326
humanhash: juliet-failed-delta-nevada
File name:file
Download: download sample
Signature GCleaner
Create hunting rule
File size:770'560 bytes
First seen:2026-01-26 17:55:34 UTC
Last seen:2026-01-26 18:43:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7d927f7b3a815d523d32714880218326 (8 x GCleaner)
ssdeep 12288:NWxa7+IlSRsrHxyG5HaQr6yBDEimb5W5c3SyE1MwMfzG:4wvlPt3Vr6yBIiEvRQ
Threatray 2'304 similar samples on MalwareBazaar
TLSH T1DEF47C12F29144B3D062FA3D8C2B8EF8542A7D543935BACD26F52DC85F7A781372A253
TrID 96.1% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
2.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
0.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
0.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 gcleaner


Avatar
Bitsight
url: http://130.12.180.43/files/unique2/random.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
95
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-01-26 17:56:59 UTC
Tags:
gcleaner loader
Link:
https://app.any.run/tasks/46a56917-3ebc-41dc-b3af-d007c7781753

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50248/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6977aac86fa3eed1652f371f
Tags:
cobalt delphi
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi fingerprint installer-heuristic keylogger packed
Link:
https://www.filescan.io/uploads/6977aace4156786ccbd85585/reports/199cfeeb-55b9-4be9-bfc4-7a459e1764ea/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972
Result
Gathering data
Verdict:
Malicious
File Type:
exe x32
Detections:
Trojan.Win32.Qshell.sb Trojan.Win32.Injector.sb Trojan.Win32.Inject.sb Trojan.Win32.Delf.sb Trojan.Win32.Agent.sb HEUR:Trojan.Win32.Qshell.gen
Link:
https://opentip.kaspersky.com/eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5684591b-6fb5-44cb-8c3c-fe2a1252b31b
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972/
Verdict:
Malicious
Threat:
Family.GCLEANER
Link:
https://tip.neiki.dev/file/eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ntlnlikuetxmjknwltpgdkt2bdgnmkqgdzopvul27y4gsehjfza._file
Verdict:
malicious
Label(s):
gcleaner
Create hunting rule
Similar samples:
1a38918a094b23b6f21269eef556533dd31c1e3139da3c1da985bb35d40a33a6
GCleaner
44e956e20e767066f5f27479436996b2f91c131c19bacd6623a72ce1ba7a6358
GCleaner
4f43a343277a31f9c477d5b47adda8ae55ae8f00c42c5e2b1b769fc559722747
GCleaner
5cd1fc9ee873f1f3d65640f0b67fa8d251d35634a29ce21853e9130d1016e205
GCleaner
9eaa406ec5b5abefb96a285724af519f7ee7c3241b75e67acee2eaa9b7a40daf
GCleaner
a95f207caf93b3447cc7d612fffeca504c71ed8945975b939422115cea301fc5
GCleaner
b357ace9d2161166465c831da5ef856bc36de458338b78944426ac7f5e8ffb1d
GCleaner
d0b44329fec0f42c9e45e7374bb90ca7349d83f62d0bd8304a1b42a5c6cd6298
GCleaner
error
GCleaner
+ 2'294 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner discovery loader
Link:
https://tria.ge/reports/260126-wh898scz5f/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
GCleaner
Gcleaner family
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
185.156.73.98
Unpacked files
SH256 hash:
eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972
MD5 hash:
9d2ea2d20846371ec4c97552bb0ad326
SHA1 hash:
1deb6a1c66642a3aacd6c495e30b3d406351c30a
Link:
https://www.unpac.me/results/6fd88ce5-32f8-4986-8ae4-781c9c2ef076/
SH256 hash:
2076128cf1559255b9366030a0aca3c98d10c909b4259f468340e2e5b773993f
MD5 hash:
81a7d67b62187091563c45eefa440c53
SHA1 hash:
8b8879ab6455d1f9ddb9a79f8ed781017a5428be
Link:
https://www.unpac.me/results/6fd88ce5-32f8-4986-8ae4-781c9c2ef076/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eb66b6ad0aa1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe eb66b6ad0aa12776254db2e6f30d53d04666b15030f2e7d68bd7f1c348874972

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3743700/
Cape
Cape
https://www.capesandbox.com/analysis/50248/

Comments