ThreatFox: GCleaner IOCs

Hunt Hypothesis

This hunt targets adversaries deploying GCleaner malware to exfiltrate sensitive credentials and financial data through covert command-and-control channels established after initial phishing or exploit kit infections. Proactively hunting for these specific IOCs in Azure Sentinel is critical to detect early-stage data theft before significant information loss occurs, given the high severity of this threat’s ability to operate silently within the network.

IOC Summary

Malware Family: GCleaner Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`cdb4ac5717e2bfe3bb375d15e53fd8741c4a35e7db4f2389c29c77d66bc5cc57`	payload	2026-07-14	95%
sha1_hash	`a912c5fa300ba329099d1ac7c71fa92452dae968`	payload	2026-07-14	95%
md5_hash	`715d3af46531f2815ab9f67b47f2472d`	payload	2026-07-14	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["cdb4ac5717e2bfe3bb375d15e53fd8741c4a35e7db4f2389c29c77d66bc5cc57", "a912c5fa300ba329099d1ac7c71fa92452dae968", "715d3af46531f2815ab9f67b47f2472d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GCleaner

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: GCleaner IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Scheduled Enterprise Backup and Sync Operations
- Scenario: Automated backup agents (e.g., Veeam, Rubrik, or Microsoft Azure Backup) initiate outbound connections to cloud storage endpoints or on-premise central repositories. These jobs often run during off-hours, generating high-volume data exfiltration traffic that mimics the “covert communication” and large data transfer patterns of GCleaner.
- Filter/Exclusion: Create an exclusion rule based on the specific Source Hostnames (e.g., backup-agent-01, sync-service) or Process Names (VeeamAgent.exe, azcopy.exe). Additionally, exclude traffic destined for known backup IP ranges defined in your asset inventory.
Patch Management and Software Update Deployments
- Scenario: System administrators utilize tools like Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or SolarWinds Patch Manager to push updates. These agents frequently establish outbound connections to vendor update servers (e.g., Microsoft Update, Adobe, or third-party software repositories) to download large payloads and report status, triggering alerts for “unexpected outbound traffic” and new C2-like communication channels.
- Filter/Exclusion: Whitelist the specific Destination Domains associated with your patch management infrastructure (e.g., *.update.microsoft.com, download.adobe.com). Furthermore, exclude connections originating from the specific service accounts used by these tools (e.g., svc-patch-deploy) during scheduled maintenance windows.
Cloud Identity and Synchronization Services
- Scenario: Tools like Microsoft Azure AD Connect, **Okta Workforce