ThreatFox: GCleaner IOCs

Hunt Hypothesis

This hunt targets the presence of six specific IOCs linked to the GCleaner malware, which adversaries deploy to execute malicious payloads and establish persistence on compromised hosts. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate infected endpoints before the malware can propagate laterally or exfiltrate sensitive data.

IOC Summary

Malware Family: GCleaner Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`af5961fcfda7a5547713454710574062dcccc9c0f91971e2303875395dba2980`	payload	2026-09-26	95%
sha1_hash	`2382fd406a05533d093721ef65d1760996cb34f9`	payload	2026-09-26	95%
md5_hash	`a023ab05e1a585ec48bdd1127570926a`	payload	2026-09-26	95%
sha256_hash	`7a99db2f37c45efe719b0de34a7eb54b63e33c0bf66059020af424799e70f756`	payload	2026-09-26	95%
sha1_hash	`f0f1986022ce311c19a962a8551d73eaa91fe8e7`	payload	2026-09-26	95%
md5_hash	`2bbcf73469d7c81350cc711af3c0127a`	payload	2026-09-26	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["af5961fcfda7a5547713454710574062dcccc9c0f91971e2303875395dba2980", "2382fd406a05533d093721ef65d1760996cb34f9", "a023ab05e1a585ec48bdd1127570926a", "7a99db2f37c45efe719b0de34a7eb54b63e33c0bf66059020af424799e70f756", "f0f1986022ce311c19a962a8551d73eaa91fe8e7", "2bbcf73469d7c81350cc711af3c0127a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GCleaner

False Positive Guidance

Scenario: A DevOps team deploys a custom cleanup script using GCleaner (or a similar utility) via Ansible or Puppet to remove temporary build artifacts from CI/CD agent nodes. The script executes the binary directly, triggering the IOC match.
- Filter/Exclusion: Exclude executions where the parent process is ansible-playbook.exe, puppet-agent.exe, or chef-client.exe, and the file path resides under a known CI/CD working directory (e.g., C:\ci\workspace\).
Scenario: An IT administrator manually runs GCleaner from a portable USB drive or a shared network drive (\\fileserver\tools\) to clear disk space on a specific server before a patching window. The binary path does not match the standard installation directory.
- Filter/Exclusion: Allow execution if the image path starts with \\ (UNC path) or matches a known tools share (e.g., C:\Program Files\IT Tools\), and the user account belongs to the IT_Admins security group.
Scenario: A security team performs a controlled test of the detection rule by executing the GCleaner sample from a dedicated lab environment or a specific test server (LAB-TEST-01). The execution is intentional but generates an alert.
- Filter/Exclusion: Exclude alerts where the hostname matches the lab naming convention (e.g., *LAB-*, *TEST-*) or the user account is sec_test_user, provided the execution occurs during a scheduled maintenance window.
Scenario: A third-party backup or disk optimization tool (e.g., Veeam, Acronis, or CCleaner Pro) bundles or calls GCleaner as a helper component during a scheduled disk cleanup