Extracted

• • Target

    2025-04-03_f31b509490ee7ab50e30dfd335ef4250_black-basta_cobalt-strike_remcos_satacom

  • Size

    56.5MB

  • MD5

    f31b509490ee7ab50e30dfd335ef4250

  • SHA1

    d8e76f0064dd77eda546f710c843e7085f8b590e

  • SHA256

    f955357b63c775908bf0c702307ef92cb996cbc64cfa5fc27958a59b1a5964b1

  • SHA512

    b7dec130be1fab4a0407b8d007b40fce5ae4943948f332e43db428d0be9b3d4f0a70ed20d692f72fc4c29fb05128ad37a389f55991af213a61f3fab6ad456e56

  • SSDEEP

    393216:iywCAqwUBzBwiwxwGwPewgxwUwswMw8wJwVwtwiwPwxwUwfwOwgadKY5OBF1/f:wczxJKP3

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1