Extracted

• • Target
    b11fa73625d6cba3dd6cf98467aea533.exe
  • Size 419KB
  • SHA256 d9cdd267e3c00ae4f70e60a45aa03f22b1a59b42526a692d0e5bde6b5f1b99d4
  • MD5 b11fa73625d6cba3dd6cf98467aea533
  • SHA1 004d3169fb9b2b6daeec6425f6da98c99a3b63e0
  • SHA512 2bba5cfaeec13bda9ffb03a16d1c2af9d85be0ec13b00d9f79e3c4ffbd334a7db00addb5b52b4f89a84a8a57349e29115d93532f866d37b9914c6b832247fdea
  • SSDEEP 6144:umHZ39YkgRaYfIIeWmfVjFsSX2/vwWJwQuuPkfwkaZeRJE1I7EOVqcEyrIXs:umHZ/cqx7sSX2nmQuSk7n8I4OVAyrI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2behavioral3behavioral4