ThreatFox: GCleaner IOCs

Hunt Hypothesis

This hypothesis targets the presence of known IOCs associated with the GCleaner malware, which may indicate an adversary has deployed a tool capable of cleaning traces of compromise or executing malicious payloads. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify potential stealthy infections or post-exploitation activities before the adversary can fully establish persistence or exfiltrate data.

IOC Summary

Malware Family: GCleaner Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`29a971dac08fc3014072ef2c7e4c8758`	payload	2026-09-04	95%
sha256_hash	`6719c071c7e08af59b520f5ca22f77e11e4a47d7d5e411f50e523f670d656495`	payload	2026-09-04	95%
sha1_hash	`9f22d44425c9425ae131332735f05502edcc1f12`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["29a971dac08fc3014072ef2c7e4c8758", "6719c071c7e08af59b520f5ca22f77e11e4a47d7d5e411f50e523f670d656495", "9f22d44425c9425ae131332735f05502edcc1f12"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GCleaner

False Positive Guidance

Scenario: A DevOps team uses a custom PowerShell cleanup script that leverages the Get-ChildItem (GC) alias or a utility named gcleaner.exe to purge temporary build artifacts and log files from CI/CD agent nodes.
- Filter/Exclusion: Exclude processes where the parent process is pwsh.exe or powershell.exe and the working directory is under C:\BuildAgent\ or C:\Jenkins\workspace\.
Scenario: An IT administrator runs a scheduled task using a third-party disk cleanup tool (e.g., CCleaner or a custom wrapper) that has been renamed to gcleaner.exe to align with internal naming conventions for maintenance scripts, executed via Task Scheduler (taskschd.msi).
- Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically the Tasks service) or explorer.exe and the image path is located in C:\Program Files\Maintenance\ or C:\AdminTools\.
Scenario: A security team deploys a YARA rule scanner or a threat hunting tool that includes a sample or test binary named gcleaner_sample.bin or gcleaner_test.exe for verification purposes in a dedicated test lab segment.
- Filter/Exclusion: Exclude hosts within the SecurityLab AD group or where the file path contains \TestLab\ or \HuntingSamples\.
Scenario: A legacy application installer or uninstaller uses a helper executable named gcleaner.dll or gcleaner.exe to remove residual registry keys and files during the uninstallation process of a specific enterprise software package.
- Filter/Exclusion: Exclude processes where the parent process is msiexec.exe or `