Extracted

Extracted

• • Target
    Setup.exe
  • Size 2.0MB
  • SHA256 a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742
  • MD5 3f970b3cc1750863a65530f8b10fc1b7
  • SHA1 5cddabef22b54c78e8a79568a83b1e8c8ff2b747
  • SHA512 e4773b5be7e0147f41e22aa031a1d1ed870c8bde382f1c02c432505bdb3dc2513ca0dcceba924e50299d9ac6c0e4e200cfbfc3038f5cb3a0aa1d49f38cadba46
  • SSDEEP 49152:06xcx0yWXe7pKUoFFLDb+9Twus084y0zjp+/kPM:06ILIUwrAsut8/wN+/kPM
  • TLSH
    T1BAA51218D7B405FDE0B3D578CE574912EB76BC4A47B1E68F03A0A9A61F272A08D3D712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverygcleanerremus_stealerloaderstealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2