MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901
SHA3-384 hash: 5dd4f91a1404d636a4c99d8ab48942c8620683c5a61a9ce10839341e69e6e1a00b059ceef0a0e78ce59fa5f343206dac
SHA1 hash: 6f266d50974b9712dcc59fd3ca8eb43973de1dca
MD5 hash: 54f923e1cbb15513b8e5092d94e703e2
humanhash: march-pennsylvania-monkey-tennessee
File name:Setup.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:5'062'998 bytes
First seen:2026-08-25 20:15:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2057790ae7855765d51bdc4142e62f9c (80 x RemusStealer, 5 x ValleyRAT, 5 x SalatStealer)
ssdeep 98304:J2VpxxUZKdU3Ka/MVqCKcuafR3R95Q6xekwxohPh3ejUOYJSg76a8Z7eJgk1K9r2:axxbU6kMYCKjA0kMoTOjKJKDo6z9rqd
TLSH T17D361205BB5420AAF8729374CFAFC691EA61F806331091DB27BC655B1EBB1F1CE1A711
TrID 93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
2.3% (.EXE) Win64 Executable (generic) (6522/11/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.7% (.EXE) OS/2 Executable (generic) (2029/13)
0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 68cc33aaaa29cc68 (1 x RemusStealer)
Reporter aachum
Tags:ClickFraud exe gcleaner RemusStealer sfx unluckytool-com


Avatar
iamaachum
https://winds11.site/aa/Setup.rar

RemusStealer C2:
http://cleasion.click:8202/sessions
http://vexdico.shop:8539/accounts
http://zakuiru.shop:9048/videos
GCleaner C2:
185.156.73.98

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
ES ES
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f5faee02-bc89-49ca-9656-e4f627db3311/
Detection:
Remus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/82783/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the %temp% subdirectories
Launching a process
Sending an HTTP POST request
Deleting a recently created file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Sending an HTTP GET request to an infection source
Changing a file
Unauthorized injection to a recently created process
Query of malicious DNS domain
Connection attempt to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug cmd fingerprint golang installer installer large-file lolbin microsoft_visual_cc msbuild overlay packed powershell reconnaissance sfx
Link:
https://www.filescan.io/uploads/6a8df80b1248c1f5b85f94e9/reports/7b8bd051-65d6-4094-95af-3c066030aa61/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-25T18:24:00Z UTC
Last seen:
2026-08-26T18:25:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/26b5f832-5c90-4e36-902a-6abb4079a7f1
Result
Threat name:
GCleaner, GO Stealer, REMUS Stealer
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1963655
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
AI detected malicious page (phishing or scam)
AI detected suspicious redirect behavior
Allocates memory in foreign processes
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Drops large PE files
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious webpage
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected GCleaner
Yara detected GO Stealer
Yara detected PhishFingerprint
Yara detected REMUS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1963655 Sample: Setup.exe Startdate: 25/08/2026 Architecture: WINDOWS Score: 100 106 45.91.200.135 PODAONLV Netherlands 2->106 108 185.156.73.98 FDN3UA Netherlands 2->108 110 50 other IPs or domains 2->110 142 Suricata IDS alerts for network traffic 2->142 144 Found malware configuration 2->144 146 Antivirus detection for dropped file 2->146 148 16 other signatures 2->148 11 Setup.exe 3 9 2->11         started        15 svchost.exe 2->15         started        18 widget.exe 2->18         started        signatures3 process4 dnsIp5 90 C:\Users\user\Desktop\appFile.exe, PE32+ 11->90 dropped 92 C:\Users\user\Desktop\ae_mixtwo.exe, PE32 11->92 dropped 94 C:\Users\user\Desktop\OpenLink.ps1, ASCII 11->94 dropped 192 Drops large PE files 11->192 20 ae_mixtwo.exe 10 11->20         started        24 wscript.exe 1 11->24         started        26 appFile.exe 11->26         started        140 127.0.0.1 unknown unknown 15->140 file6 signatures7 process8 dnsIp9 82 C:\Users\user\AppData\Local\Temp\...\re21.exe, PE32+ 20->82 dropped 150 Multi AV Scanner detection for dropped file 20->150 152 Writes to foreign memory regions 20->152 154 Allocates memory in foreign processes 20->154 156 Injects a PE file into a foreign processes 20->156 29 MSBuild.exe 39 20->29         started        34 re21.exe 3 20->34         started        158 Suspicious powershell command line found 24->158 160 Wscript starts Powershell (via cmd or directly) 24->160 162 Bypasses PowerShell execution policy 24->162 170 3 other signatures 24->170 36 powershell.exe 23 24->36         started        126 cleasion.click 207.180.248.154 CONTABODE Germany 26->126 164 Detected unpacking (creates a PE file in dynamic memory) 26->164 166 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 26->166 168 Unusual module load detection (module proxying) 26->168 file10 signatures11 process12 dnsIp13 136 91.92.242.236, 49741, 80 OMEGATECH-ASSC Netherlands 29->136 138 drive.usercontent.google.com 142.251.211.97, 443, 49740 GOOGLE-GoogleLLCUS United States 29->138 96 C:\Users\user\AppData\...\5KaoQwS99Iwj.exe, PE32+ 29->96 dropped 98 C:\Users\user\AppData\...\zSJ2vumn4zSa.exe, PE32+ 29->98 dropped 100 C:\Users\user\AppData\...\8DYUlu7LJuM.exe, PE32+ 29->100 dropped 102 10 other malicious files 29->102 dropped 194 Unusual module load detection (module proxying) 29->194 38 Ko5yRGrI7RF.exe 29->38         started        42 8DYUlu7LJuM.exe 29->42         started        45 5KaoQwS99Iwj.exe 29->45         started        53 8 other processes 29->53 196 Multi AV Scanner detection for dropped file 34->196 198 Writes to foreign memory regions 34->198 200 Modifies the context of a thread in another process (thread injection) 34->200 202 Injects a PE file into a foreign processes 34->202 47 MSBuild.exe 34->47         started        49 chrome.exe 36->49         started        51 conhost.exe 36->51         started        file14 signatures15 process16 dnsIp17 112 shhsift.click 159.65.136.5 DIGITALOCEAN-ASN-DigitalOceanLLCUS Singapore 38->112 172 Multi AV Scanner detection for dropped file 38->172 174 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 38->174 176 Tries to harvest and steal ftp login credentials 38->176 184 2 other signatures 38->184 114 flotilla.45-94-31-71.sslip.io 45.94.31.71 028f45e8dd4f225cb46a7d8003745a3a7f55d3a0DE Netherlands 42->114 84 C:\Users\user\AppData\...\flotilla.exe.part, PE32+ 42->84 dropped 86 C:\Users\user\AppData\...\flotilla.exe (copy), PE32+ 42->86 dropped 178 Unusual module load detection (module proxying) 42->178 55 flotilla.exe 42->55         started        58 cmd.exe 42->58         started        88 C:\Users\user\AppData\Local\...\widget.exe, PE32+ 45->88 dropped 180 Tries to harvest and steal browser information (history, passwords, etc) 45->180 60 widget.exe 45->60         started        116 vexdico.shop 165.227.199.109 DIGITALOCEAN-ASN-DigitalOceanLLCUS United States 47->116 118 192.168.2.6, 443, 49708, 49709 unknown unknown 49->118 120 192.168.2.9 unknown unknown 49->120 63 chrome.exe 49->63         started        122 193.221.200.26 NEONCORENETWORKSUS Netherlands 53->122 124 2 other IPs or domains 53->124 182 Antivirus detection for dropped file 53->182 66 cmd.exe 53->66         started        68 tasklist.exe 53->68         started        70 conhost.exe 53->70         started        72 5 other processes 53->72 file18 signatures19 process20 dnsIp21 186 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 55->186 188 Unusual module load detection (module proxying) 55->188 74 conhost.exe 58->74         started        128 shadowroute.io 37.228.129.245 FLOKINETIS Germany 60->128 190 Multi AV Scanner detection for dropped file 60->190 130 dl.google.com 142.250.217.14 GOOGLE-GoogleLLCUS United States 63->130 132 mobile-gtalk.l.google.com 142.250.31.188 GOOGLE-GoogleLLCUS United States 63->132 134 5 other IPs or domains 63->134 104 Chrome Cache Entry: 346, PDP-11 63->104 dropped 76 conhost.exe 66->76         started        78 Defrag.exe 66->78         started        80 conhost.exe 68->80         started        file22 signatures23 process24
Score:
81%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.20 SOS: 0.21 SOS: 0.92 Win 64 Exe x64
Link:
https://app.malva.re/file/54f923e1cbb15513b8e5092d94e703e2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901/
Threat name:
ByteCode-MSIL.Trojan.Injectornett
Create hunting rule
Status:
Malicious
First seen:
2026-08-25 20:16:17 UTC
File Type:
PE+ (Exe)
Extracted files:
51
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=awzxwacw7tjdmw24v5eeucett6zo6yyqwnvrq7zl6eac56f7neaq._file
Verdict:
malicious
Label(s):
GCleaner
Create hunting rule
Remus
Create hunting rule
Link:
https://reports.threatray.com/d0048f27-229c-4b69-950b-3316bd0fdc97
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner family:remus_stealer discovery execution loader stealer
Link:
https://tria.ge/reports/260825-y17v8sej5x/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: GCleaner
Family: Remus
Malware Config
C2 Extraction:
http://cleasion.click:8202/sessions
http://vexdico.shop:8539/accounts
http://zakuiru.shop:9048/videos
185.156.73.98
45.91.200.135
Dropper Extraction:
https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98
Unpacked files
SH256 hash:
05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901
MD5 hash:
54f923e1cbb15513b8e5092d94e703e2
SHA1 hash:
6f266d50974b9712dcc59fd3ca8eb43973de1dca
Link:
https://www.unpac.me/results/b883e0d9-3b0f-440f-ac01-54ea52daa294/
SH256 hash:
b3e188bf57cbc7a25832ea1623180c43508e31c9dfcd50c914b42954d6dd8ca9
MD5 hash:
3887291cd322703465aeb5a65f43eee7
SHA1 hash:
bf9592a2d325f2202869f067d54b9375eba1f378
Link:
https://www.unpac.me/results/b883e0d9-3b0f-440f-ac01-54ea52daa294/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/05b37b0056fc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe 05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901

(this sample)

  
Link
https://tria.ge/260825-yrqwcsycrc/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/82783/

Comments