MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GCleaner

Vendor detections: 16

Intelligence 16 IOCs YARA 6 File information Comments

SHA256 hash:	f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98
SHA3-384 hash:	d4884d30c08a2ff634c1d00034a7997daec422e4181805b6c086b94c545ec462a054be82ce3ec8e12ab36dab80750c74
SHA1 hash:	55ad23ebb47f08f84fc81e934977a3db8446695c
MD5 hash:	bb6cd52426baacb4b32ec0d26173c005
humanhash:	finch-carpet-iowa-item
File name:	SecuriteInfo.com.Win32.MalwareX-gen.7129.2787
Download:	download sample
Signature	GCleaner Create hunting rule
File size:	3'341'600 bytes
First seen:	2025-06-27 11:52:54 UTC
Last seen:	2025-06-27 12:31:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7b534b9a25699ae902e9828ac4cff114 (16 x GCleaner)
ssdeep	49152:IzxyEZl4L+25AtcGbpxtMX1l4RaEuA2LAhPrqCOnhTaLGa19eKSbkCjXXVaGqrXB:Izxys+nOtcGb3WX1lcaE1GJ9pFgr8z1I
TLSH	T10FF5F1511AD767D4D3B18BF9F85F92B0E061AD152FB6003261D79A0FFEE9E42D1020BA
TrID	52.9% (.EXE) Win32 Executable Delphi generic (14182/79/4) 16.8% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) Win16/32 Executable Delphi generic (2072/23) 7.5% (.EXE) OS/2 Executable (generic) (2029/13) 7.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe gcleaner

Intelligence

File Origin

# of uploads :

# of downloads :

415

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Win32.MalwareX-gen.7129.2787

Verdict:

Malicious activity

Analysis date:

2025-06-27 11:54:06 UTC

Tags:

delphi gcleaner loader auto generic

Link:

https://app.any.run/tasks/d93e9090-a47c-4035-89f8-cfda072b20a7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/11349/

Detection(s):

PUA.Win.Packer.BorlandDelphi-15

SecuriteInfo.com.Win32.MalwareX-gen.7129.2787.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685e86ce0fceda814b468b90

Tags:

delphi emotet cobalt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Creating a file in the %temp% directory

Creating a process from a recently created file

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Unauthorized injection to a recently created process by context flags manipulation

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context borland_delphi expired-cert fingerprint invalid-signature keylogger packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/685e8637f3dd31f50d7f7e1b/reports/fe7ae901-eced-49de-a2b9-0e6085b9a025/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98

Malware family:

RealVNC

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/33201ab5-d72b-48c4-a632-ccc38d767c5f

Score:

94%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98

Threat name:

Win32.Trojan.GCleaner

Status:

Malicious

First seen:

2025-06-27 11:53:20 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=62s3ivetn7dmybesr6u55hjy5gcrhestzwcvgkqzq7oicknvv6ma._file

Result

Malware family:

gcleaner

Score:

10/10

Tags:

family:gcleaner discovery loader

Link:

https://tria.ge/reports/250627-n2gekax1gx/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Downloads MZ/PE file

GCleaner

Gcleaner family

Malware Config

C2 Extraction:

45.91.200.135

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/208a43df-e67f-4346-89b0-1df72f13001d

Unpacked files

SH256 hash:

fb3c524bc7a45ee2dacb54e9c48021297b1ff1fb9e2875bed0ef34d72779869b

MD5 hash:

2facd74eaccdb241358757fe70eb876d

SHA1 hash:

ac8bef9ce0677f00e353b14d7ec4cf0608dd5da2

Detections:

GCleaner

Link:

https://www.unpac.me/results/c010e14a-685d-4bb3-bbb4-09b5d40c8568/

Parent samples :

305120c7430aee4534927912607380e9ee860de9733645f5811d3ec6d30b2fef
f40b66c4c0b1a812ab2efa37a8012bac41d1bbf5f8608f19158166c97738bab6
a60d3ccf8ec4eb6132cd89ebe9804d87f50323f8b3f2ad48d46ce95499b5b904
04d8a24eaef1787dd87a02f4fef83379dd3dfd587475be21db822ebd11134e83
a0ae53478fd18c1451037dcb9598b1b90550c6b1a2ed4ebab7d2b93da6e2a7e5
92c1aeb52bcc5e22d34ecc5bb74162ffbbb1d2528301390059136f7194963710
fa9afd6ba609660117c7d39473547a359a0756d66e380136c92ea62f4c7cc12b
f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98
f7268e1f614b407a2487581caec6b919cdb28c5bc1a69949fdd92b8eb931ed59
474a8d973e9fea6cba374a985c18b7ac0799711c0ae8b0ecf6d7ba62b1018d80
8678ee3d032630b94b86e48bf7008f19fcf1971199be6107720f13f7b51e6b3b
6b82e4eb367200b3a9d4dda5f41b937f0f139560d1886673a8d451559e444f91
5bdf1d38056921c118d783f994db4958e7d67b552a7d18f0092e327ce5bc8302
c24b4ebd9f45e6140ab457f577bf2bfda67eb84190b18cfc9b72e1845550d37f
12166be8b6ea0b1303063fc98357840b6ed5d2ebd670aea527143a52bc8f7c2d
7ebc8af13c8e5e7b707d53a0217f3e8498987847131be747142e4f0bd37615ca
032ce1788073869c4b93462fe487cd0101716a2b8129dee3c6a4050ac20cf99e
0a94319080b116f6b6a44812b99bb716ff848c4862af0848a1ec1759d82571cd

SH256 hash:

0a0b083cc0e62db594b7be21088202c7fe0970d609b2847085d0bf2be8e54a5c

MD5 hash:

4ce3ce196eda86d92b68362b6269b618

SHA1 hash:

fd42ee0aca0315acac25c297f1ce33634c549559

Link:

https://www.unpac.me/results/c010e14a-685d-4bb3-bbb4-09b5d40c8568/

SH256 hash:

f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98

MD5 hash:

bb6cd52426baacb4b32ec0d26173c005

SHA1 hash:

55ad23ebb47f08f84fc81e934977a3db8446695c

Link:

https://www.unpac.me/results/c010e14a-685d-4bb3-bbb4-09b5d40c8568/

Malware family:

GCleaner

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f6a5b454936f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f6a5b454936fc6cc04928fa9de9d38e985139253cd85532a1987dc8129b5af98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/11349/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA kernel32.dll::GetTempPathA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample