Malware

Gcleaner

GCleaner is a malware family identified as a pay-per-install (PPI) loader and also referenced as a fake cleaning tool used in multiple malicious campaigns. Reporting on a March 2026 Amadey botnet campaign tagged "fbf543" lists GCleaner among 24 malware families distributed over roughly 10 days via shared criminal infrastructure, supporting the assessment that it was one of several payloads offered through a financially motivated PPI service. In that campaign, delivery infrastructure included the Amadey C2 domain sys32[.]cc and backend payload hosting tied to labinstalls[.]info at 158.94.211.222, with additional delivery from qpgroup[.]top. Separate reporting on AuraStealer states that a fake cleaning tool named Gcleaner has been used as a distribution mechanism across different campaigns, alongside other loaders and execution techniques such as DLL sideloading and process injection. High-confidence content therefore supports that GCleaner is associated with malware delivery activity, functions as a known PPI loader, and has been observed in financially motivated cybercrime operations likely linked at low-to-medium confidence to CIS/Russian-speaking criminal ecosystems. No sample-specific capabilities, persistence mechanisms, or standalone IOCs unique to GCleaner itself are provided beyond these campaign associations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

MITRE ATT&CK Mapping ... Command and Control Ingress Tool Transfer T1105 Amadey downloads 50+ payloads to infected hosts

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

breakglass intelNews

Mar 12, 2026

LummaStealer's Go Loader and the fbf543 Amadey Supermarket: 50 Payloads, 13 Malware Families, and the Bulletproof Host That Ties It All Together - Breakglass Intelligence - Breakglass Intelligence

A pay-per-install loader observed among the campaign payloads.

breakglass intelNews

Mar 12, 2026

Amadey v5.x "fbf543" Campaign: A Pay-Per-Install Supermarket Running 24 Malware Families on Bulletproof Rails - Breakglass Intelligence - Breakglass Intelligence

GCleaner is described as a known PPI loader and its presence reinforces that the operation is a malware installation marketplace.

cyber security newsNews

Mar 3, 2026

Threat Actors Deploy ‘AuraStealer’ Infostealer with 48 C2 Domains and Active Campaigns

Fake cleaning tool used as part of campaigns distributing AuraStealer (likely as a lure or trojanized installer); no further technical details provided.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.