ThreatFox: GCleaner IOCs

Hunt Hypothesis

This detection identifies adversary activity linked to the GCleaner malware by monitoring specific Indicators of Compromise (IOCs) known to facilitate its initial infection and persistence mechanisms within Azure Sentinel. Proactive hunting for these IOCs is critical because early identification allows the SOC team to rapidly isolate affected endpoints, preventing lateral movement and potential data exfiltration before the threat escalates.

IOC Summary

Malware Family: GCleaner Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`3941abf37772bfdeefa1d8b8bc617f9e1ce4bd48`	payload	2026-08-28	95%
md5_hash	`801e7911d8ef33ab7843bb638c0b5abc`	payload	2026-08-28	95%
sha256_hash	`c496e8e8f7cc2e40c515c9dbd98ffce43861acaf504466f478ceaebf712214b8`	payload	2026-08-28	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["3941abf37772bfdeefa1d8b8bc617f9e1ce4bd48", "801e7911d8ef33ab7843bb638c0b5abc", "c496e8e8f7cc2e40c515c9dbd98ffce43861acaf504466f478ceaebf712214b8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GCleaner

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: GCleaner IOCs detection rule in an enterprise environment:

Scenario: Automated Endpoint Cleanup via Microsoft Intune
- Context: The IT Operations team schedules a nightly maintenance job using Microsoft Intune to deploy a custom script that invokes gcleaner.exe (or similar utility) to clear temporary files and optimize disk space on managed Windows 10/11 endpoints. This triggers the IOC match during the scheduled window (e.g., 2:00 AM – 4:00 AM).
- Suggested Filter: Exclude alerts where the Process_Name matches gcleaner.exe AND the Parent_Process_Name is msedge.exe or IntuneManagementExtension.exe, occurring only between 01:00 and 06:00 on weekdays.
Scenario: Third-Party Antivirus Maintenance Routine
- Context: The enterprise utilizes CrowdStrike Falcon or Symantec Endpoint Protection, which includes a built-in “System Cleaner” module that periodically scans for and removes obsolete registry keys and temp files using the GCleaner utility. This activity generates network traffic matching the ThreatFox IOCs during peak business hours.
- Suggested Filter: Create an exclusion rule for alerts originating from hosts where the Antivirus_Product is “CrowdStrike Falcon” or “Symantec Endpoint Protection,” provided the user context is a service account (e.g., svc_maintenance) rather than an interactive logged-in user.
Scenario: Legacy Application Deployment Script
- Context: The DevOps team utilizes Ansible to push configuration updates to legacy servers running specific line-of-business applications. The deployment playbook includes a step that executes the GCleaner tool to ensure disk space availability