Extracted

• • Target

    64af7f9e9f25ee18582134abfb8aa5bb

  • Size

    454KB

  • MD5

    64af7f9e9f25ee18582134abfb8aa5bb

  • SHA1

    0e6e0767450130dd9c96b7ebb5079a76305619b8

  • SHA256

    ffa9e2a6f918c3f822448af43232b377e2b55bd0d6a88fc098b3e92bd8a5ca4f

  • SHA512

    056cafb1c6eb785318f7cce50b92d38343693c848131564a59dd4990d8ba5d86955bbfdf634ad2bf474bbe1575dc5b97de470e758fd88f68d82557106f608072

  • SSDEEP

    12288:d6g7I41oTMIbclvGzGfUlQw4erd8LjTK8lwRRkmF5PXW:8iIIoTMIbc8zGfUlQw4erSHblww+5

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2