Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 14.9MB
  • SHA256 2b435e783dd02a969e3ebbef2e88898faa654e72fe48bca19d8328eed051b6ed
  • MD5 3b9f15072c31dd119ff9dae2bd21a084
  • SHA1 1c731ac38f884ff4e28faf3db19662ed346e1a60
  • SHA512 b711aa84c7c27505cd36225fe0aecfa3344aa43a0d8794668a3fbc75035a0986f13fb011ecfb83ead857a42b2036983cd7cd3d76d5858e7ccfc71c5c2b6a992d
  • SSDEEP 196608:rIxbU9Lx0RBLrCgZRfQZGEBzulRP52w5Jg+c/lNoza1jWDO5glNi1jwFfqw4:c+oTf3uyf52w52tro+1QPikl4
  • TLSH
    T13BF63345FBA03969F87753308FB389A2DE313C4A036191EB5790756A1DFB1D4DE2A322
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerremus_stealerloaderspywarestealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4