Extracted

Extracted

• • Target
    Setup.exe
  • Size 656KB
  • SHA256 eede323c8bd0370140dd9be6fbb92c82cef64210171325352f3e96e7026d3bfe
  • MD5 043ecb65c4d4003504dc1d2324bdc7d0
  • SHA1 adfd78e5d0ff90d4d9212f69a4cb5bf95256f463
  • SHA512 f0ecec63805244a96ec2887360356c17949c5ffb0a0c40c593ea5026fcc3a499d13ce0ec6024b7d63e646a898be0d070daba2f1c75a076e2fc802a56f20cb76a
  • SSDEEP 12288:D+ZPf6yIvNeNF682QTY8ZO5NQW41vMPALj7w:69f0YKsTR0zQWsIR
  • TLSH
    T1B7E48E22A2E0C437D2621E7D9D1FE3ED9836BE102D2994462BD45D4C7EF8E837966343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoverygcleanerremus_stealersocks5systemzinstallerloaderspywarestealer

  • Detect Socks5Systemz Payload

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2