MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f16f3e9413e6042a9258aa1994c2ada35c64888ee2779a10efdf9132e94768e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f16f3e9413e6042a9258aa1994c2ada35c64888ee2779a10efdf9132e94768e0
SHA3-384 hash: c13fa343b42f2241dea745e3039aa726eed7f6a9b58ad6dfa7a2a4c76b02f0a39604aeba9297d00537711138439df9c5
SHA1 hash: 09a54707bbc6f4d5a5e41e77364cd0e834a0a2d7
MD5 hash: 6e4e0633e221337e74f0930e073bfc85
humanhash: violet-carolina-carolina-quebec
File name:6e4e0633e221337e74f0930e073bfc85.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:441'344 bytes
First seen:2023-04-12 12:47:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 65e26f7361921acdd644477d2064c736 (3 x Smoke Loader, 2 x Vidar, 1 x GCleaner)
ssdeep 6144:Vb42XzcmFevL5dOtOYtbd/4jp9B5lXMV4YAv6kLum1UBJLtvPz:VbZzcvT5dOQAV4jp9BzM3vu/U
Threatray 41 similar samples on MalwareBazaar
TLSH T1D594AE1256D1A830E52A97F18E1FC6F4663EB5209F267AEB37E55A3F39301E1E132314
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon cad8f4f0f0f0e8e4 (1 x GCleaner)
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6e4e0633e221337e74f0930e073bfc85.exe
Verdict:
Malicious activity
Analysis date:
2023-04-12 12:50:48 UTC
Tags:
gcleaner
Link:
https://app.any.run/tasks/72f810af-9851-4ea6-bce0-011df5113724

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nymaim
Create hunting rule
Link:
https://www.capesandbox.com/analysis/381789/
Detection(s):
Sanesecurity.Malware.29209.BadIN.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/77602/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware khalesi lockbit packed
Link:
https://www.filescan.io/uploads/6436a884e90389fc714b3bd3/reports/e7d9dd54-0e2f-4fb9-99f3-d28a264979cf/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f16f3e9413e6042a9258aa1994c2ada35c64888ee2779a10efdf9132e94768e0
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f474b213-2c26-419c-bdce-396a7b952d75
Result
Threat name:
Nymaim
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1212544
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Nymaim
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f16f3e9413e6042a9258aa1994c2ada35c64888ee2779a10efdf9132e94768e0/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-04-12 12:48:07 UTC
File Type:
PE (Exe)
Extracted files:
57
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6fxt5fat4yccvesyvimzjqvnunogjceo4j3zuehp36itf2khndqa._file
Verdict:
malicious
Similar samples:
10af69687adac380f3c3ba45e5f6fc871a65af7f0f94ed7424eee1f22e3ca17c
GCleaner
15ba5f21577d3311960e290f21ebe12044d467a87e04dc5a07ba630bdb54e369
GCleaner
2958e5a56f8e43eecc073d15df9b232d30d40d39bc6b73dc373a3ff0a1bf2c5a
GCleaner
69500efc24f57d2bf67e957d9c838b744efe99aaa2f4d353e721813fb2de2185
GCleaner
7d2114030808140042fdcd43cbff77a879cb090be1e6a8986d4e79d27d51332e
GCleaner
a8604d1185e93f54fca91fb6658e865f3ef22c0ddd7710c30ec940ebbc4fdd98
GCleaner
d05faa3accafd17c997f954412a861208477f3deb4a60e8154b8a75aaac05989
GCleaner
ef1dc5ac69c9a84268abdc6fd6d368fa6cf814bfcde72c0217ee0ed2d5d88722
GCleaner
f5208ef9cbe92137116fc9983860ed80e9c39d1beca8855d1457d010bc43ad80
GCleaner
ff19ac956ccbf295cf9364d8cca046c7bd4c01758ae584e518d232f7d79cbf2c
GCleaner
+ 31 additional samples on MalwareBazaar
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner loader
Link:
https://tria.ge/reports/230412-p1sxmscd26/
Behaviour
Program crash
Downloads MZ/PE file
GCleaner
Malware Config
C2 Extraction:
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Unpacked files
SH256 hash:
a834564da52cc30dca95c3cfc1bf018488385a25d646cd444728c39221f9ebad
MD5 hash:
4c38f2ae9db829b51b396c55cd7a3bd6
SHA1 hash:
9abfc63b48b37828cc745c977c61c3ae499265c6
Detections:
Nymaim
Create hunting rule
win_nymaim_g0
Create hunting rule
win_gcleaner_w0
Create hunting rule
win_gcleaner_auto
Create hunting rule
Link:
https://www.unpac.me/results/98587bed-903f-4f23-80a3-6bdae5a6c703/
Parent samples :
f16f3e9413e6042a9258aa1994c2ada35c64888ee2779a10efdf9132e94768e0
faeffb395139b51e0c53f62d7103bc8cdda88fcb719b51a83d81efd627a9aca6
8c6bfffaefbed85b6e6ce800bc512ef0500545dd526abed161cbac3bee9dac3f
3a2d68aa79103015eb0bcb538e90d5713d0b5fa59974938263d11f4262932c00
bb4f0fcf0b94915848c24fc234bd9cb2918e155d1cb9aef074cc6fdd7e3da335
SH256 hash:
f16f3e9413e6042a9258aa1994c2ada35c64888ee2779a10efdf9132e94768e0
MD5 hash:
6e4e0633e221337e74f0930e073bfc85
SHA1 hash:
09a54707bbc6f4d5a5e41e77364cd0e834a0a2d7
Link:
https://www.unpac.me/results/98587bed-903f-4f23-80a3-6bdae5a6c703/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f16f3e9413e6042a9258aa1994c2ada35c64888ee2779a10efdf9132e94768e0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/381789/

Comments