← Back to SOC feed Coverage →

ThreatFox: GCleaner IOCs

ioc-hunt HIGH ThreatFox
DeviceFileEvents
iocthreatfoxwin-gcleaner
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-25T11:00:00Z · Confidence: high

Hunt Hypothesis

This hypothesis detects adversary behavior involving the deployment of GCleaner indicators, which often signal post-compromise cleanup or lateral movement activities within the network. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify potential threat persistence and validate the effectiveness of existing security controls against known malicious signatures.

IOC Summary

Malware Family: GCleaner Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

TypeValueThreat TypeFirst SeenConfidence
md5_hash8498ec75a9609ce1d1a27138fccf246apayload2026-07-2595%
sha1_hash0bc36272c7b85c9b61ea7774a9aade9c6da49d4bpayload2026-07-2595%
sha256_hashe2ade9d3303ff03e5e73c8d90da926e3c2390aa3698924d2397c692138c9a141payload2026-07-2595%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["8498ec75a9609ce1d1a27138fccf246a", "0bc36272c7b85c9b61ea7774a9aade9c6da49d4b", "e2ade9d3303ff03e5e73c8d90da926e3c2390aa3698924d2397c692138c9a141"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: GCleaner IOCs detection rule in an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/win.gcleaner/