Extracted

Extracted

• • Target
    2026-08-22_4dda8f314cc90279dfbb432eb39a868a_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 15.9MB
  • SHA256 42c2c18036a33df2229285065cdcbd7d6fbfd1cdbb9b121fc0160f98c075add7
  • MD5 4dda8f314cc90279dfbb432eb39a868a
  • SHA1 6ef3420028f394c62bf52e4b297fcfe004ad124c
  • SHA512 a9c9e1ad80ea40f66472c0334c3d1494c294089260e9d1d42fee573213d3d5dc6bcebc3f21a3f7608026729a0a742d610c3870d4b671d42c79cee5253ba91621
  • SSDEEP 393216:OsSRdRToAtLS42IsAF+qpOfpW8GVVmdT4IcmnSddqOOZ:hSRlsAF/EHd8Ic6SdVOZ
  • TLSH
    T1B9F6334AA3D430EDE0A2C970898A9711F735BCD5AF20CAAF1795F9275F72654A03C339
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongcleanerloader

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2