Gcleaner

GCleaner is a malware family identified in the provided reporting as a pay-per-install (PPI) loader and as a fake cleaning tool used across multiple campaigns. It was observed among the 24 malware families distributed in a March 2026 Amadey botnet campaign tagged "fbf543," which Breakglass Intelligence assessed as a financially motivated PPI operation likely linked to the CIS cybercrime ecosystem. In that campaign, GCleaner was delivered alongside numerous other payloads including Vidar, LummaStealer, QuasarRAT, XWorm, SmokeLoader, AsyncRAT, DarkVisionRAT, HijackLoader, CoinMiner, and remote access tooling such as ConnectWise ScreenConnect. The campaign used Amadey infrastructure including sys32[.]cc as a Cloudflare-proxied C2 and labinstalls[.]info at 158.94.211.222 for backend payload hosting, with additional delivery infrastructure on qpgroup[.]top. Separately, Gcleaner is also explicitly described as a fake cleaning tool used in AuraStealer distribution chains, where AuraStealer operators employed loaders, DLL sideloading, malicious .NET DLLs, Donut shellcode loaders, process injection into legitimate Windows binaries, and social-engineering-driven delivery such as ClickFix. One mention context also lists suspected GCleaner C2 infrastructure under /advertisting/plus.php on 45.12.253.56, with related IPs 45.12.253.72 and 45.12.253.98. Based on the provided content, the high-confidence characterization is that GCleaner is a fake cleaner-themed loader used as part of criminal malware delivery ecosystems rather than a standalone stealer or RAT.