MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GCleaner


Vendor detections: 16


Intelligence 16 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605
SHA3-384 hash: f0395eb48898a3b0b3aa0b5ee20f79d7fa6f14da254a1226f08a554f77ade98c571ce1de238e96185f1a40bdbf5b5fe7
SHA1 hash: 4b8032852f12da0b3e99bb38e7bea6d22d81b2c0
MD5 hash: 4ac25e77c048dd7e1b4fabd33c721627
humanhash: texas-ohio-hawaii-avocado
File name:4ac25e77c048dd7e1b4fabd33c721627.exe
Download: download sample
Signature GCleaner
Create hunting rule
File size:4'720'640 bytes
First seen:2025-03-09 12:40:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 98304:v7OcCKRV7iWDlYwws2kuCT8UUHLXmBayfspraBAJ27K1zG1EK/lc:vacdOTC2kuu8tr20yYaBAyQzCt
Threatray 7 similar samples on MalwareBazaar
TLSH T1E326339FAB7B2E39D142B272E72C41DAB2EEEE1F156182EDA71820F05077B595307314
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4504/4/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon 96b2e8cce8b28e06 (60 x GCleaner, 1 x Formbook)
Reporter abuse_ch
Tags:exe gcleaner

Intelligence

File Origin
# of uploads :
1
# of downloads :
408
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4ac25e77c048dd7e1b4fabd33c721627.exe
Verdict:
Malicious activity
Analysis date:
2025-03-09 12:49:24 UTC
Tags:
themida golang gcleaner loader auto generic
Link:
https://app.any.run/tasks/4c397016-22a0-4ae8-972d-ac40019beae0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67cd901f0d1b39e3a208713c
Tags:
cobalt micro virus hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Launching a process
Creating a file in the %temp% subdirectories
Creating a file
Connection attempt to an infection source
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed packer_detected
Link:
https://www.filescan.io/uploads/67cd8c6f3c5f644bd949da5b/reports/eea0d542-3f5e-4b94-8cbe-22dbc4d4b141/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c9a6fa1b-9f16-4a44-b21d-3bee61cc8248
Result
Threat name:
GCleaner
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1632964
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Writes to foreign memory regions
Yara detected GCleaner
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Suspicious
First seen:
2025-03-08 12:59:07 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=74zy75gxoxbqwnpsozwd6v7w4etcdj3zgyzrrh3fbqgyaozd6ycq._file
Verdict:
malicious
Label(s):
gcleaner
Create hunting rule
Similar samples:
1d36e74839d7e149caab4dcf031cbc723e2ef37aa7ac421bd93a791ef91f471d
GCleaner
3cdb245eb031230d5652ea5a1160c0cbbb6be92fb3ea3cf2ee14b3d84677fc77
GCleaner
6291dbd7d818441a2dca3285483774e9d377e63a53516bc4e43e26a4c2b80b2a
GCleaner
6a4fbba9403d7c9c5f9f0be2172c284eacd540a4018049078bf7be1889ec0c99
GCleaner
9ffc9c79fda80cd0af0c52c1f3cbed8e19d97a5bb7dd838b7c4397dd6fd8d80c
GCleaner
e37aafd3e82efb761200214eb57e95055dd99324109f3b3cd4078d8e0be9b225
GCleaner
error
GCleaner
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner defense_evasion discovery loader
Link:
https://tria.ge/reports/250309-pwwgza1vhx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks BIOS information in registry
Identifies Wine through registry keys
Loads dropped DLL
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
GCleaner
Gcleaner family
Malware Config
C2 Extraction:
185.156.73.73
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6c2eab34-5b35-42d4-8f64-5894ac0704a3
Unpacked files
SH256 hash:
ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605
MD5 hash:
4ac25e77c048dd7e1b4fabd33c721627
SHA1 hash:
4b8032852f12da0b3e99bb38e7bea6d22d81b2c0
Link:
https://www.unpac.me/results/d500bbd7-2f20-4859-9085-ec4ebd4a3b23/
SH256 hash:
a2dd32bf57b01f7e079aa3dd48f6ebb661cb275c88ec8368cffbfd90215aef92
MD5 hash:
fbf7629948ea0090b233f064c5eb5798
SHA1 hash:
673702b7f504d6bf38d4a2b2be40461c9aba3891
Link:
https://www.unpac.me/results/d500bbd7-2f20-4859-9085-ec4ebd4a3b23/
SH256 hash:
d52430a2fc5ca1c60ad37fcc564c1706df0277fb583bfe91468969630cb7e60b
MD5 hash:
a3ff41e837a0864472b97ddb337e2f65
SHA1 hash:
6e5fb148976512c506bb11d5ebc66168b1d66ff1
Detections:
GCleaner
Create hunting rule
Link:
https://www.unpac.me/results/d500bbd7-2f20-4859-9085-ec4ebd4a3b23/
Parent samples :
ffab54a5b0b77ee2d3ebe3d0bd42f5ee52af594691a8b465b426ca91107c380d
9f768badd73c47a68ceabde639429d3b53b40270186eae8bce35b2f2aaa8628d
68e68c7846ecb07a272ab44beb4033c13a00296c6de7e02c20a4bf7fb7e757d3
3c9b4123d9f1f2287c85c45351985b73e010a0930e62b8f6921b6f637fc39d2c
f015832f63fc14131c401ab786f243cfc9a543fdd734c8710c61e664886f565c
0b6967f41a54cb499a30e44e1161f549684097d543a10907ad250e76b4dfa66d
6829cd3363711317c4908ab9d8cef51acb8644eee67399863b12d330af1d595c
7d020d703679b4f2654e61f3f5a636370735b7c669553cf3f03fea60b29c9031
a2920217eeae4b1c17f47dc1e09d2ab7e0d45d08c145260a2ed2aa351e0f4066
0c5789417d3d30ec72050cd456c8d46e5239ec9744f3db60fcc25e3725dc4228
e37aafd3e82efb761200214eb57e95055dd99324109f3b3cd4078d8e0be9b225
1d36e74839d7e149caab4dcf031cbc723e2ef37aa7ac421bd93a791ef91f471d
0ee296e9ea61e07c1c0448a51cccc2274c2c0bb1fa4f311dd2c6608fed76a821
6291dbd7d818441a2dca3285483774e9d377e63a53516bc4e43e26a4c2b80b2a
9ffc9c79fda80cd0af0c52c1f3cbed8e19d97a5bb7dd838b7c4397dd6fd8d80c
979d7afda8224f12d4fbf3baf313d34317869d30e52608fe3e2f959fa2998b49
a02496bfd7675a37043304198ee5b9efb075376e4ef1509fbbd5e83e190211f6
c4875eca80c1b5458aa8529ddf0d975d18e66af126dda3910846e305694b4982
ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605
bca2d58f5317010c58ffb96cbd119bda713aeb1989515aadcccadc1ed58baa46
42a5fd5225ed262fe0382e21fc08dcae9c92b5af19e237b34acf48aaff55e99c
6f707c0e645a4793567ab3871562891a81e11ac8ab5b6fe347ac22c00b71242b
4b00e3fb45e726560aea516e414c8136525d6f5477aef8cd1a408c1ff00b5674
f3708ff4e6f004210643548e8162f46eb1f252d598446b7ca0dca38092f0c55c
0384dc663505eb0a8f6eea00db223587ee2344ebe9184557ec88f248f6c28bc3
dbfc0265fc606666bbaf8f19039c4379d9162b8e054f027d92cc5fc37ae24014
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ff338ff4d775/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_Threat_23d33b48
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GCleaner

Executable exe ff338ff4d775c30b35f2766c3f57f6e12621a7793633189f650c0d803b23f605

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3452050/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments