Extracted

Extracted

• • Target
    Setup.exe
  • Size 2.1MB
  • SHA256 2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9
  • MD5 e34755b68490cf2b1e876da6c6d0135f
  • SHA1 b0c782b109d2cba64ae8a9e5cd8a2fe22145069b
  • SHA512 26d65a1d425c93f65f8883f975a16a78b5a36ea3d663f9a4498b92ef8d6bc2a32de21ae01b57aedb5e52a3094e98229a8ed10647b063ea79c7c82042d6774bbb
  • SSDEEP 49152:06xcx0yWje7pKUoFFLDb+9TwusxyQjyKg0Po1ReMXiS:06ILIUwrAsuLR0mReWF
  • TLSH
    T1C3A5121DD7F405FDE0B3D174CA974916EB767C4A47B1E6CF03A0A9A61E232908D39B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverygcleanerremus_stealerloaderstealer

  • Detects Remus stealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2