MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemusStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 14 File information Comments

SHA256 hash:	8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137
SHA3-384 hash:	c20adb4dffe486a983b6b5d35ee6e587a218dc43e1876a46ce106441c972f6a6e29cde5c055e0fcdfa4c401afbd577ae
SHA1 hash:	0c7481ffcf1ceee98e3500c552cec40c6d7d8fbe
MD5 hash:	0cd74763c8271e198bd5d3bcc2a3bb1e
humanhash:	mike-hydrogen-oranges-alanine
File name:	Setup.exe
Download:	download sample
Signature	RemusStealer Create hunting rule
File size:	4'868'385 bytes
First seen:	2026-08-25 20:21:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2057790ae7855765d51bdc4142e62f9c (80 x RemusStealer, 5 x SalatStealer, 5 x ValleyRAT)
ssdeep	98304:rKAoxUZKdU9yaNCil45SMCn1+DoF3mncXMB8/rM2wH1eRm:rAxbU9yaLCEZnkDoFWn9sZwsM
TLSH	T1F2362346A7A430FCE062D9748945CB01F3357C89AB70DAAB27D8FA672F63140D92D736
TrID	93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 2.3% (.EXE) Win64 Executable (generic) (6522/11/2) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.7% (.EXE) OS/2 Executable (generic) (2029/13) 0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	9494b494d4aeaeac (917 x DCRat, 486 x NirCmd, 172 x RedLineStealer)
Reporter	aachum
Tags:	ClickFraud exe gcleaner RemusStealer sfx unluckytool-com

iamaachum

https://winds11.site/aa/Setup.rar

RemusStealer C2:
http://smareach.click:6534/exports
http://vexdico.shop:8539/users
http://kupzovo.shop:7567/subscriptions
GCleaner C2:
91.92.242.236

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6b048286-0572-4b6d-8623-db8bffddd734/

Detection:

Remus

Link:

https://www.capesandbox.com/analysis/82788/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Creating a process from a recently created file

Changing a file

Launching a service

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Creating a file in the %temp% subdirectories

Launching a process

Deleting a recently created file

Connection attempt to an infection source

Sending an HTTP POST request

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Unauthorized injection to a recently created process

Query of malicious DNS domain

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-08-25T18:24:00Z UTC

Last seen:

2026-08-27T15:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3b06c960-2570-49fd-abee-43c39e09f65c

Result

Threat name:

GCleaner, REMUS Stealer

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1963668

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Allocates memory in foreign processes

Antivirus detection for dropped file

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Detected unpacking (creates a PE file in dynamic memory)

Drops large PE files

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Potentially malicious time measurement code found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Unusual module load detection (module proxying)

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected GCleaner

Yara detected REMUS Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

93%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.20 SOS: 0.21 SOS: 0.92 Win 64 Exe x64

Link:

https://app.malva.re/file/0cd74763c8271e198bd5d3bcc2a3bb1e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137/

Threat name:

Win64.Trojan.Malgent

Status:

Malicious

First seen:

2026-08-25 20:22:27 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

25 of 38 (65.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r6nfuw62pxb7v4ovzn2pbng4mnsdvm53ebprdhsylrpsscw4se3q._file

Verdict:

malicious

Label(s):

GCleaner

Remus

Socks5Systemz

Link:

https://reports.threatray.com/7489dbeb-55d0-422b-a00b-1fc64ba8ac0b

Result

Malware family:

remus_stealer

Score:

10/10

Tags:

family:gcleaner family:remus_stealer discovery execution loader stealer

Link:

https://tria.ge/reports/260825-y5ncdsvybv/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Family: GCleaner

Family: Remus

Malware Config

C2 Extraction:

http://smareach.click:6534/exports
http://vexdico.shop:8539/users
http://kupzovo.shop:7567/subscriptions
185.156.73.98
45.91.200.135

Dropper Extraction:

https://wappingerbicornshaps.com/s4r7aa2f7f74b7ac2ab0af7589004c3a8ef07971edb98

Unpacked files

SH256 hash:

8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137

MD5 hash:

0cd74763c8271e198bd5d3bcc2a3bb1e

SHA1 hash:

0c7481ffcf1ceee98e3500c552cec40c6d7d8fbe

Link:

https://www.unpac.me/results/1d89c249-49dd-4e35-9b92-7f22dd5c58b6/

SH256 hash:

b3e188bf57cbc7a25832ea1623180c43508e31c9dfcd50c914b42954d6dd8ca9

MD5 hash:

3887291cd322703465aeb5a65f43eee7

SHA1 hash:

bf9592a2d325f2202869f067d54b9375eba1f378

Link:

https://www.unpac.me/results/1d89c249-49dd-4e35-9b92-7f22dd5c58b6/

Malware family:

GCleaner

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8f9a5a5bda7d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SelfExtractingRAR Create hunting rule
Author:	Xavier Mertens
Description:	Detects an SFX archive with automatic script execution

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.