Extracted

Extracted

Extracted

• • Target
    af1762c75e7da96ca5bc1181e2cdb343b4b4309366e16aec1fe4bc0ff39d26fa.zip
  • Size 14.5MB
  • SHA256 c01c70dcc40bb1f8cbeb02cb0530b35b069af8c9dd86ac766596604cc56b7e25
  • MD5 f410ef8ffb6acd2f991282c56bb7ed2d
  • SHA1 19c37625f587f9d7af016349e3da1fa34bb97a7c
  • SHA512 3fe89a4e22a44c198661f3b773b938224601fafe0ca89dc7d9ca66ab5572a474a28ff18ff86eddec130e7359176927ab98ade277bd4418a13bd8ae71cbcc4cda
  • SSDEEP 393216:qaFpY+5gmtpqXti5nIIERHDSOLmzR2o4qOnYgCxJS:qV+5gsMXtonIIWSOqzR2o+n0k
  • TLSH
    T1A4E633DE742DAAAFDBD8B3121147DBFF46D84712A0DF087B55989B01006E7CAFCA4258
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    af1762c75e7da96ca5bc1181e2cdb343b4b4309366e16aec1fe4bc0ff39d26fa.exe
  • Size 14.7MB
  • SHA256 af1762c75e7da96ca5bc1181e2cdb343b4b4309366e16aec1fe4bc0ff39d26fa
  • MD5 3b4f5f7d230b26a7d6a25bbaf37ccb33
  • SHA1 60c7d887184cbdbc58009b3287ee4ac0632ea473
  • SHA512 cfc0de252f275c51ddebcae5257ec9561cf76e60a176c45149f03f7dbff44b59883ade1d862ee84d5cda3dd17ee480dc307af308ca8f7b3eb10721e16df72b0a
  • SSDEEP 393216:GfDVmJxt3+s3kYyDrJosD7C+5dq4fLM2s2NuoIGPsP:GM9ynZDW+5dq4A2s2EckP
  • TLSH
    T199F63349EBA030B5F8628174CEF7DA91EA723C46435195DB1BC878875EB76D0CF26322
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerremus_stealerloaderpersistencespywarestealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral2