Extracted

• • Target

    379ebead1fb22627691fbd82cdc97817.exe

  • Size

    425KB

  • MD5

    379ebead1fb22627691fbd82cdc97817

  • SHA1

    9c8d1836d857ea0368fcc882b6b089900f203e08

  • SHA256

    1a10164e5cdc3ddbc96e75468254a421b1646b24934a6bde3313229fc6f26f0e

  • SHA512

    1be3d939a8dbb1a8bb44d56239aa1474e7f0123b40289747a3a0bb7dfc9fb0a581dca0752f6d26518e7d9e745d654e52a82809cec1afbafb285a044f6cae728c

  • SSDEEP

    6144:0JEb+g8Yjk5egDV4jDfi0swLwn94drMZMY5/Ge9aPcziZnJ37Lf1Ik5eLe9g:cESg/k5eYaXLIXZMc9TW1J3Xfn5e

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2behavioral3behavioral4