Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 15.1MB
  • SHA256 57713a4f584665cbb42ecddd749459c10c7a369e3b1beaaabd4d694891e16933
  • MD5 b40366aadc86b16f62ae3b6e25c3ca65
  • SHA1 9b463b9c5967a4b1204aaa04d0637cc946359d95
  • SHA512 9d8ed93b524cd6b13c06102f0f1f47c2ede0ac965940df9e7f24517985ff0767d7313ce8e8b6c254f5b357664ecb2c55cc20cab84de74404af0d8f164fc87810
  • SSDEEP 393216:mvt/rZuc0fo/TaMoXTaaqGaWuEmpkvCOc7yZYY7XyrlroqJ:m1zcdA/TaMiaaqLJppD+CAyrlrtJ
  • TLSH
    T1B9F63301EBA4716AFCA6DA3CCEB3CAD0E935BC46072552EB27D8545F1EB71D1C62A301
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerremus_stealerloaderspywarestealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2