MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9
SHA3-384 hash: 6e60e927d26c6a76ed865967d8a6a3d0c07744d629a8c6f7d80d5d2bbae1e7cb8425367dc4c2f6ef6300f2e39ba6c8c5
SHA1 hash: b0c782b109d2cba64ae8a9e5cd8a2fe22145069b
MD5 hash: e34755b68490cf2b1e876da6c6d0135f
humanhash: hydrogen-purple-sodium-venus
File name:Setup.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:2'204'940 bytes
First seen:2026-08-13 23:44:12 UTC
Last seen:2026-08-15 08:57:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2057790ae7855765d51bdc4142e62f9c (54 x RemusStealer, 5 x ValleyRAT, 5 x SalatStealer)
ssdeep 49152:06xcx0yWje7pKUoFFLDb+9TwusxyQjyKg0Po1ReMXiS:06ILIUwrAsuLR0mReWF
TLSH T1C3A5121DD7F405FDE0B3D174CA974916EB767C4A47B1E6CF03A0A9A61E232908D39B22
TrID 93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
2.3% (.EXE) Win64 Executable (generic) (6522/11/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.7% (.EXE) OS/2 Executable (generic) (2029/13)
0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 9494b494d4aeaeac (912 x DCRat, 486 x NirCmd, 172 x RedLineStealer)
Reporter aachum
Tags:exe gcleaner RemusStealer sfx unluckytool-com


Avatar
iamaachum
https://smmnet.store/Setup.rar

GCleaner C2: 91.92.242.236
RemusStealer C2:
http://clledge.biz:7752/messages
http://mrlketo.shop:8932/comments
http://vexdico.shop:8539/posts
http://shkpiva.shop:5627/sessions
http://beljaro.shop:2536/addresses
http://tokjoza.shop:5200/collections
72.62.195.74:8932
85.31.60.169:5627
191.252.159.33:8539
195.222.53.130:5902

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
ES ES
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0990e0f5-2a8e-4238-817a-924c7e73ca3a/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-08-13 23:59:15 UTC
Tags:
gcleaner loader stealer remus golang auto generic
Link:
https://app.any.run/tasks/c60e9f1f-16a8-4bdb-8f7a-96150714b1f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/80955/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Deleting a recently created file
Launching a process
Creating a file in the %temp% subdirectories
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Replacing files
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Connection attempt to an infection source
Query of malicious DNS domain
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug base64 cmd crypto fingerprint golang installer installer installer-heuristic lolbin microsoft_visual_cc msbuild overlay packed reconnaissance sfx
Link:
https://www.filescan.io/uploads/6a7e56e512c8e658b85c306b/reports/20a1a25d-49b8-4520-98ae-cb81f9f2dac4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-13T18:41:00Z UTC
Last seen:
2026-08-15T09:31:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/548a04b3-92f3-4094-a6e8-691276124a78
Result
Threat name:
GCleaner, REMUS Stealer, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1957968
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Creates a thread in another existing process (thread injection)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (creates a PE file in dynamic memory)
DNS related to crypt mining pools
Early bird code injection technique detected
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Uses the Windows Restart Manager Abuse for Browser Credential File unlocking
Uses whoami command line tool to query computer and username
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected GCleaner
Yara detected MSIL Injector
Yara detected REMUS Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1957968 Sample: Setup.exe Startdate: 14/08/2026 Architecture: WINDOWS Score: 100 122 xmr-eu1.nanopool.org 2->122 124 45.91.200.135 PODAONLV Netherlands 2->124 126 25 other IPs or domains 2->126 162 Suricata IDS alerts for network traffic 2->162 164 Found malware configuration 2->164 166 Antivirus detection for dropped file 2->166 170 16 other signatures 2->170 12 Setup.exe 7 2->12         started        15 svchost.exe 20 2->15         started        18 svchost.exe 2->18         started        signatures3 168 DNS related to crypt mining pools 122->168 process4 file5 114 C:\Users\user\Desktop\xqAAE.exe, PE32+ 12->114 dropped 116 C:\Users\user\Desktop\ae_mixtwo_2.exe, PE32 12->116 dropped 20 ae_mixtwo_2.exe 6 12->20         started        24 xqAAE.exe 1 12->24         started        224 Unusual module load detection (module proxying) 15->224 27 WerFault.exe 2 15->27         started        29 WerFault.exe 15->29         started        31 WerFault.exe 15->31         started        signatures6 process7 dnsIp8 108 C:\Users\user\AppData\Local\Temp\...\11.exe, PE32+ 20->108 dropped 182 Multi AV Scanner detection for dropped file 20->182 184 Writes to foreign memory regions 20->184 186 Allocates memory in foreign processes 20->186 188 Injects a PE file into a foreign processes 20->188 33 MSBuild.exe 37 20->33         started        38 11.exe 3 20->38         started        40 WerFault.exe 21 16 20->40         started        128 mrlketo.shop 72.62.195.74, 49736, 49737, 8932 AS-HOSTINGERCY Malaysia 24->128 130 tarkioweb.com 176.53.159.66 ORACLE-BMC-31898-OracleCorporationUS Turkey 24->130 190 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 24->190 192 Creates HTML files with .exe extension (expired dropper behavior) 24->192 194 Tries to steal Mail credentials (via file / registry access) 24->194 196 4 other signatures 24->196 file9 signatures10 process11 dnsIp12 118 91.92.242.236, 49734, 80 OMEGATECH-ASSC Netherlands 33->118 120 drive.usercontent.google.com 142.251.2.132, 443, 49730 GOOGLE-GoogleLLCUS United States 33->120 100 C:\Users\user\AppData\...\PUuQSUV2CfB.exe, PE32+ 33->100 dropped 102 C:\Users\user\AppData\...\pIMrSM9nzBavB.exe, PE32+ 33->102 dropped 104 C:\Users\user\AppData\...\tQKLp5pGkrteO.exe, PE32+ 33->104 dropped 106 9 other malicious files 33->106 dropped 172 Unusual module load detection (module proxying) 33->172 42 tQKLp5pGkrteO.exe 33->42         started        47 5ociOJVEDzv.exe 33->47         started        49 vuq9NLcMNc.exe 33->49         started        55 5 other processes 33->55 174 Writes to foreign memory regions 38->174 176 Allocates memory in foreign processes 38->176 178 Modifies the context of a thread in another process (thread injection) 38->178 180 Injects a PE file into a foreign processes 38->180 51 MSBuild.exe 38->51         started        53 WerFault.exe 38->53         started        file13 signatures14 process15 dnsIp16 136 serdaregitim.com 185.93.68.46 TWO-E-TELEKOMTR Turkey 42->136 138 ity.beri303.org 104.21.48.6, 443, 49740 CLOUDFLARENET-CloudflareIncUS Canada 42->138 140 telegram.me 149.154.167.99, 443, 49739 TELEGRAMVG United Kingdom 42->140 110 C:\ProgramData\f08e312bbf\ccda4a21.exe, PE32+ 42->110 dropped 112 C:\ProgramData\f08e312bbf\cbfec305.exe, PE32 42->112 dropped 198 Multi AV Scanner detection for dropped file 42->198 200 Early bird code injection technique detected 42->200 202 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 42->202 218 11 other signatures 42->218 57 firefox.exe 42->57         started        60 chrome.exe 42->60         started        62 msedge.exe 42->62         started        204 Writes to foreign memory regions 47->204 220 2 other signatures 47->220 64 MSBuild.exe 47->64         started        67 WerFault.exe 47->67         started        142 shkpiva.shop 85.31.60.169, 49738, 5627 AS-HOSTINGERCY Brazil 49->142 206 Detected unpacking (creates a PE file in dynamic memory) 49->206 208 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 49->208 210 Tries to steal Mail credentials (via file / registry access) 49->210 212 Tries to steal from password manager 49->212 222 2 other signatures 51->222 144 me-ycpi-cf-www.g06.yahoodns.net 209.73.190.11, 443, 49742 YAHOO-YSM-SC8-YahooHoldingsIncUS United States 55->144 146 95.164.53.193, 49741, 5001 QWINS-LTDQWINSAS-SETAS213702AS-CUSTOMERSGB Germany 55->146 148 3 other IPs or domains 55->148 214 Antivirus detection for dropped file 55->214 216 Uses whoami command line tool to query computer and username 55->216 69 systeminfo.exe 55->69         started        71 cmd.exe 55->71         started        73 cmd.exe 55->73         started        75 7 other processes 55->75 file17 signatures18 process19 dnsIp20 132 127.0.0.1 unknown unknown 57->132 134 87.120.104.144 SINOWORLDWIDEHK Norway 64->134 152 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 64->152 154 Tries to steal Mail credentials (via file / registry access) 64->154 156 Tries to harvest and steal browser information (history, passwords, etc) 64->156 160 4 other signatures 64->160 77 chrome.exe 64->77         started        158 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 69->158 79 conhost.exe 69->79         started        81 WMIC.exe 71->81         started        83 conhost.exe 71->83         started        85 conhost.exe 73->85         started        87 Defrag.exe 73->87         started        89 conhost.exe 75->89         started        91 Defrag.exe 75->91         started        93 3 other processes 75->93 signatures21 process22 process23 95 chrome.exe 77->95         started        98 Conhost.exe 81->98         started        dnsIp24 150 www.google.com 142.251.150.119 GOOGLE-GoogleLLCUS United States 95->150
Score:
82%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.16 SOS: 0.21 Win 64 Exe x64
Link:
https://app.malva.re/file/e34755b68490cf2b1e876da6c6d0135f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9/
Threat name:
Win64.Spyware.Injectornett
Create hunting rule
Status:
Malicious
First seen:
2026-08-13 23:46:05 UTC
File Type:
PE+ (Exe)
Extracted files:
27
AV detection:
16 of 24 (66.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fwkmt3awyodk6ftfwpxkufxjz74epajw6h24aapabjhdlxkvbp4q._file
Verdict:
malicious
Label(s):
Amadey
Create hunting rule
GCleaner
Create hunting rule
Remus
Create hunting rule
Socks5Systemz
Create hunting rule
Link:
https://reports.threatray.com/e16314cd-7c6e-4b41-9631-4b6340a01996
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner family:remus_stealer discovery loader stealer
Link:
https://tria.ge/reports/260813-3rf4dahm9t/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Detects Remus stealer
Family: GCleaner
Family: Remus
Malware Config
C2 Extraction:
http://clledge .biz:7752/messages
http://mrlketo.shop:8932/comments
http://vexdico.shop:8539/posts
185.156.73.98
45.91.200.135
Unpacked files
SH256 hash:
2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9
MD5 hash:
e34755b68490cf2b1e876da6c6d0135f
SHA1 hash:
b0c782b109d2cba64ae8a9e5cd8a2fe22145069b
Link:
https://www.unpac.me/results/917ae027-da2d-444c-8d03-87c25062fb68/
SH256 hash:
7ca7c0d114090a1c5bcd7a5d68a395434c4797a231cd13f1c7550e87dfe065f7
MD5 hash:
09632e5ffd4062d492575dacb0d615b8
SHA1 hash:
9092e681e62b6f704ea4c8ffc1e4724a83fed475
Link:
https://www.unpac.me/results/917ae027-da2d-444c-8d03-87c25062fb68/
SH256 hash:
45148da9d1283d886118b60d07611d41d346d734a89fb44263ee8696f3bf053b
MD5 hash:
17ad22af995ee858a4164452c2f80e4a
SHA1 hash:
e09da2824df6f1104b72c2b570be207ef3716f3d
Link:
https://www.unpac.me/results/917ae027-da2d-444c-8d03-87c25062fb68/
SH256 hash:
b96cb378d3168e5fdec28c9328e40f6b3901b79f3bc492d0954abe2493828f93
MD5 hash:
0006e2d85e5426120f40f8d8df8c1795
SHA1 hash:
875155bc32e1706a600db3c953f66560406cdb9e
Link:
https://www.unpac.me/results/917ae027-da2d-444c-8d03-87c25062fb68/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2d94c9ec16c3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe 2d94c9ec16c386af1665b3eeaa16e9cff8478136f1f5c001e00a4e35dd550bf9

(this sample)

GCleaner

Executable exe 45148da9d1283d886118b60d07611d41d346d734a89fb44263ee8696f3bf053b

  
Link
https://tria.ge/260813-3kdpnszwcs/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/80955/
  
Dropping
SHA256 45148da9d1283d886118b60d07611d41d346d734a89fb44263ee8696f3bf053b
  
Dropping
MD5 17ad22af995ee858a4164452c2f80e4a
  
Dropping
SHA256 b96cb378d3168e5fdec28c9328e40f6b3901b79f3bc492d0954abe2493828f93
  
Dropping
MD5 0006e2d85e5426120f40f8d8df8c1795

Comments