MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 15


Intelligence 15 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f
SHA3-384 hash: ecd53d80a2c32cd2d5a21ccb58eaf1859d956ecf9c3f5de2b61b02430020bd27e402c85f26be6a3e608a31c0162b5041
SHA1 hash: 0bbd1e0431be11360db29d1bd4c82cd4668dbe4e
MD5 hash: 3363371af3e5f5960c924990bac5a118
humanhash: failed-saturn-golf-four
File name:file
Download: download sample
Signature GCleaner
Create hunting rule
File size:811'520 bytes
First seen:2026-01-28 17:52:07 UTC
Last seen:2026-02-05 15:55:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 421f57ebeade5946b16f0c3c541d2697 (21 x GCleaner)
ssdeep 12288:a9eONBtJzhKJd6EPXNQyxbLSoGZ87ig6zIQN5uG:wnzz04EGOzs8mrIQz
Threatray 2'322 similar samples on MalwareBazaar
TLSH T1F9058E22F171903BD2279B785C6F866F54267D152938986A37E93DCCCF367C2242728B
TrID 96.1% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
2.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
0.6% (.EXE) Win32 Executable (generic) (4504/4/1)
0.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
0.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 gcleaner


Avatar
Bitsight
url: http://130.12.180.43/files/unique2/random.exe

Intelligence

File Origin
# of uploads :
11
# of downloads :
129
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
vidar
Create hunting rule
ID:
1
File name:
_ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f.exe
Verdict:
Malicious activity
Analysis date:
2026-01-28 17:52:30 UTC
Tags:
gcleaner loader autoit auto-startup stealc stealer vidar delphi reverseloader ta558 apt payload stegocampaign stego auto-reg api-base64 xor-url generic upx
Link:
https://app.any.run/tasks/c3b0d778-01eb-4a8d-860a-9e2367bd8d8f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50548/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697a4cd6bec9764f452fa6c9
Tags:
cobalt delphi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 borland_delphi fingerprint installer-heuristic keylogger packed
Link:
https://www.filescan.io/uploads/697a4cd112c4ad8c0858f734/reports/9ec25426-83d8-489a-b2f7-c68bc2ce0770/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-28T14:57:00Z UTC
Last seen:
2026-01-30T06:22:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Agent.sb HEUR:Trojan-Dropper.Win32.Dapato.gen Trojan.Win32.Qshell.sb Trojan.Win32.Injector.sb Trojan.Win32.Inject.sb Trojan.Win32.Delf.sb
Link:
https://opentip.kaspersky.com/ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/95615f78-18de-4f2e-bd51-2522b6c7760e
Score:
80%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f/
Verdict:
Malicious
Threat:
Family.GCLEANER
Link:
https://tip.neiki.dev/file/ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f
Threat name:
Win32.Trojan.GCleaner
Create hunting rule
Status:
Malicious
First seen:
2026-01-28 17:52:22 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=56cdjcaighkhxm33azxk33gw64bo52u6xk7qltis36kaeq4x3qpq._file
Verdict:
malicious
Label(s):
gcleaner
Create hunting rule
Similar samples:
0e042ba8a51e96cba318389fe03439dd78c246713399f32599ce4137c10f3f05
GCleaner
1af08f835b47e538dbda63e7cb67012574082dcb9c8a3c278fec3f86d8a5bd6b
GCleaner
48ed81c4e13f43eda7dbc0cd13c8aeecead1b4b7e9c3e29c95fe5ecf4b1a1557
GCleaner
841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e
GCleaner
86376bfbb4b5a4de6157731014dec06c717c0523a5f8834520149222e359164f
GCleaner
c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910
GCleaner
db056d6446e4d93f62984607c0453c86761943fcafdf251e6800c7f6a739a6bc
GCleaner
error
GCleaner
f2d254433fcbde36e81393d6955a8de5663ded648aba5c3d9c47deb370c0ca74
GCleaner
f43dee4cf9aac69c8c73bf4fb6e5b5de8326267f6eb0f125d468eee40b332cde
GCleaner
+ 2'312 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner discovery loader
Link:
https://tria.ge/reports/260128-wfvztsgy9b/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
GCleaner
Gcleaner family
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
185.156.73.98
Unpacked files
SH256 hash:
021b2757c6b5b7461bea15a721110567fcd26e839d794046ca32ac64068ec54a
MD5 hash:
f03158c197bdd5ceb5595ccdbf381906
SHA1 hash:
70a8416757469994651d633830c83e205bf2fd82
Link:
https://www.unpac.me/results/b02353ba-abbb-4f6e-9611-335d86944b5c/
SH256 hash:
ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f
MD5 hash:
3363371af3e5f5960c924990bac5a118
SHA1 hash:
0bbd1e0431be11360db29d1bd4c82cd4668dbe4e
Link:
https://www.unpac.me/results/b02353ba-abbb-4f6e-9611-335d86944b5c/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ef8434880831/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.46
Link:
https://yomi.yoroi.company/submissions/ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe ef8434880831d47bb37b066eadecd6f702eeea9ebabf05cd12df94024397dc1f

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3743700/
Cape
Cape
https://www.capesandbox.com/analysis/50548/

Comments