Extracted

• • Target

    636fb917c49769200381edf82768548c

  • Size

    441KB

  • MD5

    636fb917c49769200381edf82768548c

  • SHA1

    3aaf21d6fc5e94dc42bf816a8ca29467a184436c

  • SHA256

    3a1fb857968ba65d496b97bb4a47c2e3d775a4b820bfe5f9aa24257fe8abbac2

  • SHA512

    78bea4ed0b521d2ef190fb1fd2541c1e80d349086eadb95d78f6e802dd17fafcf59a47632e622cb64b1d2322d0d184be7f6c89b7c975c4ef9a88324a47789d16

  • SSDEEP

    12288:gv80oCk/3vdYHO151WLMWirScN8oln8SsKH:hX3vdYDirWolx

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2