Extracted

Extracted

• • Target
    2026-08-19_a981c0e45e4a8a5ff3232b1a1d1626b4_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 16.7MB
  • SHA256 a0d550525750b126f141140df46b6877fac010e90eba0cb0bd7da24c1f5d678b
  • MD5 a981c0e45e4a8a5ff3232b1a1d1626b4
  • SHA1 f45475b7ea76d5cca8489288ab6ed692b9163c9e
  • SHA512 48db23fe847d63dd67a1891f94520ecbe2796f866d80f5234c53e3be85bf2df15af1f9475929abc7420724cb403f9066e72eac0ad7dd2e63e196b70a0c740beb
  • SSDEEP 393216:5Cp7gQr1inWXRrfFk/cjzDAsRPuMSmJLQN+ibo5xEQFJ1Cfcqt3F:+gQ5wWXRrfbXnRPuMSeHv1ct3F
  • TLSH
    T169073304BBA43478FD768274CEB387E1EE657817471191E323D4A52B1EF71E2CA2A361
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerloader

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2