MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742
SHA3-384 hash: 8813fa194041fa532c6affa141807414756df1f76b292883a8134916f20aa8f9acf63ec860e411deeb17b04a5dd67655
SHA1 hash: 5cddabef22b54c78e8a79568a83b1e8c8ff2b747
MD5 hash: 3f970b3cc1750863a65530f8b10fc1b7
humanhash: fix-quiet-double-missouri
File name:Setup.exe
Download: download sample
File size:2'077'973 bytes
First seen:2026-08-16 01:03:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2057790ae7855765d51bdc4142e62f9c (5 x ValleyRAT, 5 x SalatStealer, 4 x QuasarRAT)
ssdeep 49152:06xcx0yWXe7pKUoFFLDb+9Twus084y0zjp+/kPM:06ILIUwrAsut8/wN+/kPM
TLSH T1BAA51218D7B405FDE0B3D578CE574912EB76BC4A47B1E68F03A0A9A61F272A08D3D712
TrID 93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
2.3% (.EXE) Win64 Executable (generic) (6522/11/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.7% (.EXE) OS/2 Executable (generic) (2029/13)
0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 9494b494d4aeaeac (909 x DCRat, 486 x NirCmd, 172 x RedLineStealer)
Reporter aachum
Tags:exe gcleaner RemusStealer sfx unluckytool-com


Avatar
iamaachum
https://winds11.site/Setup.rar

GCleaner C2:
91.92.242.236
RemusStealer C2:
http://clledge.biz:7752/messages
http://mrlketo.shop:8932/comments
http://vexdico.shop:8539/posts
72.62.195.74:8932
191.252.159.33:8539

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
ES ES
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9e036e44-ddb7-40a0-a80d-4d7df4da5e6f/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-08-16 01:13:28 UTC
Tags:
golang gcleaner loader stealer remus auto generic
Link:
https://app.any.run/tasks/82d48865-a91a-4ad5-a84f-181475b4572d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/81336/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the %temp% subdirectories
DNS request
Connection attempt
Launching the default Windows debugger (dwwin.exe)
Replacing files
Unauthorized injection to a recently created process
Query of malicious DNS domain
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 cmd crypto downloader fingerprint golang installer installer installer-heuristic lolbin microsoft_visual_cc msbuild overlay packed reconnaissance sfx
Link:
https://www.filescan.io/uploads/6a810c9826cd569853cbf6c1/reports/2f1b89db-5fb4-4653-80ad-d042c1d0b6f4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/15dc702c-0080-49da-b6a2-685a2af4343d
Result
Threat name:
GCleaner, REMUS Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1958567
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Creates HTML files with .exe extension (expired dropper behavior)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected GCleaner
Yara detected REMUS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1958567 Sample: Setup.exe Startdate: 16/08/2026 Architecture: WINDOWS Score: 100 48 45.91.200.135 PODAONLV Netherlands 2->48 50 185.156.73.98 FDN3UA Netherlands 2->50 52 13 other IPs or domains 2->52 62 Suricata IDS alerts for network traffic 2->62 64 Found malware configuration 2->64 66 Antivirus detection for URL or domain 2->66 68 9 other signatures 2->68 9 Setup.exe 7 2->9         started        signatures3 process4 file5 38 C:\Users\user\Desktop\xqAAE.exe, PE32+ 9->38 dropped 40 C:\Users\user\Desktop\ae_mixtwo.exe, PE32 9->40 dropped 12 ae_mixtwo.exe 6 9->12         started        16 xqAAE.exe 1 9->16         started        process6 dnsIp7 42 C:\Users\user\AppData\Local\Temp\...\11.exe, PE32+ 12->42 dropped 78 Multi AV Scanner detection for dropped file 12->78 80 Writes to foreign memory regions 12->80 82 Allocates memory in foreign processes 12->82 84 Injects a PE file into a foreign processes 12->84 19 11.exe 3 12->19         started        22 MSBuild.exe 17 12->22         started        26 WerFault.exe 22 16 12->26         started        44 lomeqpe.com 176.53.159.66, 443, 49767 ORACLE-BMC-31898-OracleCorporationUS Turkey 16->44 46 mrlketo.shop 72.62.195.74, 49754, 49764, 49765 AS-HOSTINGERCY Malaysia 16->46 86 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->86 88 Creates HTML files with .exe extension (expired dropper behavior) 16->88 90 Tries to steal Mail credentials (via file / registry access) 16->90 92 8 other signatures 16->92 file8 signatures9 process10 dnsIp11 70 Allocates memory in foreign processes 19->70 72 Modifies the context of a thread in another process (thread injection) 19->72 74 Injects a PE file into a foreign processes 19->74 28 MSBuild.exe 19->28         started        32 WerFault.exe 19->32         started        54 91.92.242.236, 49760, 80 OMEGATECH-ASSC Netherlands 22->54 56 drive.usercontent.google.com 172.217.75.132, 443, 49755 GOOGLE-GoogleLLCUS United States 22->56 34 C:\Users\user\AppData\Local\Temp\...\YCL.exe, PE32 22->34 dropped 36 C:\Users\user\...\Bunifu_UI_v1.5.3.dll, PE32 22->36 dropped 76 Unusual module load detection (module proxying) 22->76 file12 signatures13 process14 dnsIp15 58 fightwa.biz 195.222.53.130, 49769, 5902 BIHNETBIHNETAutonomusSystemBA Bosnia & Herzegovina 28->58 60 ethereum-rpc.publicnode.com 172.66.150.162, 443, 49768 CLOUDFLARENET-CloudflareIncUS Canada 28->60 94 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 28->94 96 Unusual module load detection (module proxying) 28->96 signatures16
Score:
82%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.16 SOS: 0.21 Win 64 Exe x64
Link:
https://app.malva.re/file/3f970b3cc1750863a65530f8b10fc1b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742/
Threat name:
Win64.Trojan.Gcleaner
Create hunting rule
Status:
Malicious
First seen:
2026-08-16 01:04:32 UTC
File Type:
PE+ (Exe)
Extracted files:
27
AV detection:
19 of 36 (52.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uttvad26gyhtgir4kbg2psktrfh7ebj75rxvw2tmu5zly6fgc5ba._file
Result
Malware family:
remus_stealer
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner family:remus_stealer discovery loader stealer
Link:
https://tria.ge/reports/260816-be46wsar7s/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Downloads MZ/PE file
Family: GCleaner
Family: Remus
Malware Config
C2 Extraction:
http://clledge .biz:7752/messages
http://mrlketo.shop:8932/comments
http://vexdico.shop:8539/posts
185.156.73.98
45.91.200.135
Unpacked files
SH256 hash:
a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742
MD5 hash:
3f970b3cc1750863a65530f8b10fc1b7
SHA1 hash:
5cddabef22b54c78e8a79568a83b1e8c8ff2b747
Link:
https://www.unpac.me/results/4bc3d51c-1106-4e34-b3c0-ab3ab47485e9/
SH256 hash:
7ca7c0d114090a1c5bcd7a5d68a395434c4797a231cd13f1c7550e87dfe065f7
MD5 hash:
09632e5ffd4062d492575dacb0d615b8
SHA1 hash:
9092e681e62b6f704ea4c8ffc1e4724a83fed475
Link:
https://www.unpac.me/results/4bc3d51c-1106-4e34-b3c0-ab3ab47485e9/
SH256 hash:
45148da9d1283d886118b60d07611d41d346d734a89fb44263ee8696f3bf053b
MD5 hash:
17ad22af995ee858a4164452c2f80e4a
SHA1 hash:
e09da2824df6f1104b72c2b570be207ef3716f3d
Link:
https://www.unpac.me/results/4bc3d51c-1106-4e34-b3c0-ab3ab47485e9/
SH256 hash:
d82decfc37200dbb03a77293bbd47df17e9f1bcd7ff51febdcadcf818b45b1a7
MD5 hash:
3e2676e41e31466e37dd9a5d307c43dc
SHA1 hash:
e3dac7fdf399610b39cb33ca9e922d5fa5d1be90
Link:
https://www.unpac.me/results/4bc3d51c-1106-4e34-b3c0-ab3ab47485e9/
Malware family:
GCleaner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a4e7500f5e36/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742

(this sample)

Executable exe d82decfc37200dbb03a77293bbd47df17e9f1bcd7ff51febdcadcf818b45b1a7

  
Link
https://tria.ge/260816-a5kphaxvfw/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/81336/
  
Dropping
SHA256 d82decfc37200dbb03a77293bbd47df17e9f1bcd7ff51febdcadcf818b45b1a7
  
Dropping
MD5 3e2676e41e31466e37dd9a5d307c43dc

Comments