Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 14.9MB
  • SHA256 49b81f37896cb76b7a2b54a1bdac64caeb1513abf26ddc8da5f9e24f9ab74390
  • MD5 09c991e1f56af909d17f19f0ebef6965
  • SHA1 0cb6feec9a866cd70ccf980545482fea2bc1ab50
  • SHA512 ca46e80144f309523f49147d360456c138d1761ec947ed683a04d75c545e29a2eaa19001b6b7bfde86ef330176d8156bc101ad8165edb0de790abe5a7e27c5bb
  • SSDEEP 393216:sDbpWrHctdOoDVQkCwd41bqtK979Gvmi/G0H7g3B:svpWrSE4a1bx9JWH7cB
  • TLSH
    T12DF63316979070EDF152D4B88889C741F735BC8AAB70CAD7179CFAAB2F52590EA0C335
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerremus_stealerloaderstealerspyware

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4