Extracted

Extracted

• • Target

    28253286098972f1fe91412ef99a759a

  • Size

    5.9MB

  • MD5

    28253286098972f1fe91412ef99a759a

  • SHA1

    c5f51069a3f9270d79bacff246b0ca86887b98c6

  • SHA256

    4d04f5f44c21f9ccda28433bddea30ce2fba7a548d7d40a46332e0d2b70079d0

  • SHA512

    6373384150ec0dcf916d776a09a900092ff95a3f47e10684a8b43bbd200e2817ec6d89eb7e2da0dfac64a4535acda26b101b97d580ae4d8199cbe89c75b5bd29

  • SSDEEP

    98304:RohD0nge1EtzppRfNAlG9H3bZGjiwwRk7v:RohrgEpBNAlwH3siwwab

  Score

  10^/10

  gcleaneronlyloggersocelarsloaderstealerxmrigminer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • OnlyLogger payload

  • XMRig Miner payload

    miner

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2