MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemusStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b
SHA3-384 hash: b1010611b22f60b052d249897a9605ea7d5b205db9d23a526954e04bfa2ea79acd44df22fb5d3afca9f68cc59537be6d
SHA1 hash: d4b46417437b7be247b60df6c6804cbfe179ac21
MD5 hash: fa5b9ea9f85fe1980f0f5063ce44cc0a
humanhash: seven-xray-grey-virginia
File name:Setup.exe
Download: download sample
Signature RemusStealer
Create hunting rule
File size:16'708'092 bytes
First seen:2026-08-22 01:42:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2057790ae7855765d51bdc4142e62f9c (54 x RemusStealer, 5 x ValleyRAT, 5 x SalatStealer)
ssdeep 393216:3Gyl/dRToAPS2wRg1CKID+EFXXhEMXZfD9KEhxyrltKUeZOxc:2yl/DSf8CXD+4HXXZ4EhkZtKUeoe
TLSH T1E3F63308EFD470B6FD639231CEB786D4DA39BC06076096EB17A0945B1DB72D1CA36722
TrID 93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
2.3% (.EXE) Win64 Executable (generic) (6522/11/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.7% (.EXE) OS/2 Executable (generic) (2029/13)
0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 9494b494d4aeaeac (912 x DCRat, 486 x NirCmd, 172 x RedLineStealer)
Reporter aachum
Tags:37-187-155-230 ClickFraud exe gcleaner RemusStealer sfx Stealc unluckytool-com


Avatar
iamaachum
https://winds11.site/aa/Setup.rar

GCleaner C2:
91.92.242.236
Other C2:
37.187.155.230

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
ES ES
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0982d761-009d-480b-b538-995ca2839c8a/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82450/
Detection(s):
SecuriteInfo.com.Trojan.Siggen33.48708.1935.19143.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Launching a process
Deleting a recently created file
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Changing a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Moving a recently created file
Replacing files
Creating a window
Searching for the window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Connection attempt to an infection source
Query of malicious DNS domain
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug cmd fingerprint golang installer installer installer-heuristic large-file lolbin microsoft_visual_cc msbuild overlay packed packed powershell reconnaissance sfx
Link:
https://www.filescan.io/uploads/6a88feb1ca9b8c022679eac9/reports/51545bfb-3d70-482a-a53d-d3edf1365675/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/efc437f1-bde6-456b-b7e9-d227535003d3
Result
Threat name:
GCleaner, REMUS Stealer, Stealc
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1962108
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Drops large PE files
Found malware configuration
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected GCleaner
Yara detected REMUS Stealer
Yara detected Stealc
Yara detected Stealc v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1962108 Sample: Setup.exe Startdate: 22/08/2026 Architecture: WINDOWS Score: 100 61 45.91.200.135 PODAONLV Netherlands 2->61 63 185.156.73.98 FDN3UA Netherlands 2->63 65 12 other IPs or domains 2->65 109 Suricata IDS alerts for network traffic 2->109 111 Found malware configuration 2->111 113 Antivirus detection for URL or domain 2->113 115 13 other signatures 2->115 10 Setup.exe 3 9 2->10         started        14 svchost.exe 2->14         started        signatures3 process4 dnsIp5 49 C:\Users\user\Desktop\appFile.exe, PE32+ 10->49 dropped 51 C:\Users\user\Desktop\ae_mixtwo.exe, PE32 10->51 dropped 53 C:\Users\user\Desktop\OpenLink.ps1, ASCII 10->53 dropped 131 Drops large PE files 10->131 17 ae_mixtwo.exe 10 10->17         started        21 wscript.exe 1 10->21         started        23 appFile.exe 12 10->23         started        87 127.0.0.1 unknown unknown 14->87 file6 signatures7 process8 dnsIp9 47 C:\Users\user\AppData\Local\Temp\...\r19.exe, PE32+ 17->47 dropped 89 Multi AV Scanner detection for dropped file 17->89 91 Writes to foreign memory regions 17->91 93 Allocates memory in foreign processes 17->93 95 Injects a PE file into a foreign processes 17->95 26 r19.exe 3 17->26         started        29 MSBuild.exe 17 17->29         started        97 Suspicious powershell command line found 21->97 99 Wscript starts Powershell (via cmd or directly) 21->99 101 Bypasses PowerShell execution policy 21->101 107 3 other signatures 21->107 33 powershell.exe 23 21->33         started        75 37.187.155.230, 49760, 80 OVHFR France 23->75 103 Detected unpacking (creates a PE file in dynamic memory) 23->103 105 Unusual module load detection (module proxying) 23->105 file10 signatures11 process12 dnsIp13 121 Multi AV Scanner detection for dropped file 26->121 123 Writes to foreign memory regions 26->123 125 Modifies the context of a thread in another process (thread injection) 26->125 127 Injects a PE file into a foreign processes 26->127 35 MSBuild.exe 26->35         started        83 91.92.242.236, 49759, 80 OMEGATECH-ASSC Netherlands 29->83 85 drive.usercontent.google.com 142.251.2.132, 443, 49758 GOOGLE-GoogleLLCUS United States 29->85 57 C:\Users\user\AppData\Local\Temp\...\YCL.exe, PE32 29->57 dropped 59 C:\Users\user\...\Bunifu_UI_v1.5.3.dll, PE32 29->59 dropped 129 Unusual module load detection (module proxying) 29->129 39 chrome.exe 33->39         started        41 conhost.exe 33->41         started        file14 signatures15 process16 dnsIp17 67 zakuiru.shop 209.38.82.72, 49792, 9048 DIGITALOCEAN-ASN-DigitalOceanLLCUS Australia 35->67 69 vexdico.shop 191.252.159.33, 49789, 8539 LocawebServicosdeInternetSABR Brazil 35->69 73 2 other IPs or domains 35->73 117 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 35->117 119 Unusual module load detection (module proxying) 35->119 71 192.168.2.5, 138, 443, 49494 unknown unknown 39->71 43 chrome.exe 39->43         started        signatures18 process19 dnsIp20 77 www.google.com 142.251.152.119, 443, 49768, 49773 GOOGLE-GoogleLLCUS United States 43->77 79 android.l.google.com 142.251.2.102, 443, 49787, 49788 GOOGLE-GoogleLLCUS United States 43->79 81 7 other IPs or domains 43->81 55 Chrome Cache Entry: 271, PDP-11 43->55 dropped file21
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.21 SOS: 0.22 SOS: 0.92 Win 64 Exe x64
Link:
https://app.malva.re/file/fa5b9ea9f85fe1980f0f5063ce44cc0a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b/
Threat name:
Win64.Trojan.HulkAggressive
Create hunting rule
Status:
Malicious
First seen:
2026-08-22 01:43:19 UTC
File Type:
PE+ (Exe)
Extracted files:
45
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxg2rgv6ruizfrqplywoi2xrh72konar5mvncmi77ah5krkbyifq._file
Verdict:
malicious
Label(s):
GCleaner
Create hunting rule
Remus
Create hunting rule
Link:
https://reports.threatray.com/c84ef81e-c74c-4a9a-a7f0-85af0e895404
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner discovery execution loader
Link:
https://tria.ge/reports/260822-b5cjkazflg/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Family: GCleaner
Malware Config
C2 Extraction:
185.156.73.98
45.91.200.135
Dropper Extraction:
https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98
Unpacked files
SH256 hash:
8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b
MD5 hash:
fa5b9ea9f85fe1980f0f5063ce44cc0a
SHA1 hash:
d4b46417437b7be247b60df6c6804cbfe179ac21
Link:
https://www.unpac.me/results/1de08554-55a1-4400-b3a6-63db5da49ac0/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8dcda89abe8d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemusStealer

Executable exe 8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b

(this sample)

  
Link
https://tria.ge/260822-blk2lazepd/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/82450/

Comments