Extracted

Extracted

Extracted

• • Target
    Setup.exe
  • Size 14.9MB
  • SHA256 86f27425624e99fca1a6735b4ed5e192f575794e57f16c47a1e068bb1e608d6a
  • MD5 0054d2622e335797a8697982af417982
  • SHA1 863adf6289db25fdc4ac0ef2e1a2ae63d43366b9
  • SHA512 e733e48c94bae8f2432b86999eb30cbf2fa629dada22d945a215d5652dddfad0f060260db378a3dc029b34ba1702b640f7cb468368547d2b9f1824ee89b4ceac
  • SSDEEP 393216:Psr//yRj3zzD2I8Pm0eBkXnZAKcQYFh2kvvJYxXxSyXK+o:P9Rj3zGI8kBONcXh2a6PXJo
  • TLSH
    T1C5F63305A76031ABFCB29134DFE786D0DB72780B072495EB27E4A95B1FA71D1CB2A710
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerremus_stealerloaderstealerspywaredefense_evasion

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4