Extracted

Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 2.1MB
  • SHA256 2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9
  • MD5 e34755b68490cf2b1e876da6c6d0135f
  • SHA1 b0c782b109d2cba64ae8a9e5cd8a2fe22145069b
  • SHA512 26d65a1d425c93f65f8883f975a16a78b5a36ea3d663f9a4498b92ef8d6bc2a32de21ae01b57aedb5e52a3094e98229a8ed10647b063ea79c7c82042d6774bbb
  • SSDEEP 49152:06xcx0yWje7pKUoFFLDb+9TwusxyQjyKg0Po1ReMXiS:06ILIUwrAsuLR0mReWF
  • TLSH
    T1C3A5121DD7F405FDE0B3D174CA974916EB767C4A47B1E6CF03A0A9A61E232908D39B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverygcleanerremus_stealerloaderspywarestealerbotnet6b32989820461c8ba2bd87be20243059collectionexecutionamadeysocks5systemzvidarinstallerpersistencetrojan

  • Detect Socks5Systemz Payload

  • Detects Amadey x86-bit Payload

  • Detects Remus stealer

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4