Gcleaner

GCleaner is a Windows pay-per-install malware loader used to download and execute additional payloads on compromised systems. It has also been referred to as Garbage Cleaner and has been observed masquerading as a fake system-cleaning utility, including branding that imitates legitimate cleaning software. The malware is part of the commodity cybercrime loader ecosystem and has been seen both as a standalone PPI loader and as a payload distributed by other malware delivery services such as PrivateLoader, NullMixer, and Amadey-linked campaigns.

GCleaner communicates with command-and-control infrastructure over HTTP, reports installation-related status information, and retrieves additional executables for local execution. Observed samples beacon to remote servers, transmit installation markers associated with BroomCleaner branding, download follow-on binaries, write them to temporary storage, and launch them via standard Windows execution APIs. In at least one analyzed case, the downloaded follow-on payloads were assessed as StealC samples, demonstrating GCleaner’s role as a malware delivery mechanism rather than an end-stage payload.

Distribution has been tied to malicious software-crack and fake-download ecosystems. It has been observed in campaigns using SEO poisoning and lure sites advertising cracked software, where victims are directed to password-protected archives containing installers that deploy multiple malware families. GCleaner has also been associated with fake cleaning-tool lures. Through these ecosystems it has been used alongside or in proximity to families such as Raccoon Stealer, RedLine, SmokeLoader, Vidar, and other commodity malware.

The malware targets Windows systems and is relevant across broad opportunistic victim populations rather than a single vertical. Its operational role is primarily initial payload delivery and staging for financially motivated cybercrime activity.