Extracted

Extracted

Extracted

• • Target
    2026-08-21_4722cd9d199bcb21429ce0609f016f99_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 14.6MB
  • SHA256 ad7d865ba9f5349594bbe34a67b0608b424525af9823841195a0b9837d17ae5f
  • MD5 4722cd9d199bcb21429ce0609f016f99
  • SHA1 424c970d9a0912b1a5c5541da36b0829938665a5
  • SHA512 6b300ef775b888fc54ce3771a1528db7a65eb441eb6871fadcf5898fc952dbc37996589a34962482da8fba52bc04be8d2042e73becd871f9892832fbdcf74f50
  • SSDEEP 393216:vC6zrebipCh7oTh8kzqYA2W7xrcOs46SDYisCrRsECHmRXZ3wJ:frebSK0Tzev7xr4SgOBCGDgJ
  • TLSH
    T1E6F63305E7A024EDE463C874CA89E715F3713C85A660E66B2BD8DB573F63090E92C736
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerremus_stealerloaderstealer

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2