Extracted

• • Target

    b11fa73625d6cba3dd6cf98467aea533.exe

  • Size

    419KB

  • MD5

    b11fa73625d6cba3dd6cf98467aea533

  • SHA1

    004d3169fb9b2b6daeec6425f6da98c99a3b63e0

  • SHA256

    d9cdd267e3c00ae4f70e60a45aa03f22b1a59b42526a692d0e5bde6b5f1b99d4

  • SHA512

    2bba5cfaeec13bda9ffb03a16d1c2af9d85be0ec13b00d9f79e3c4ffbd334a7db00addb5b52b4f89a84a8a57349e29115d93532f866d37b9914c6b832247fdea

  • SSDEEP

    6144:umHZ39YkgRaYfIIeWmfVjFsSX2/vwWJwQuuPkfwkaZeRJE1I7EOVqcEyrIXs:umHZ/cqx7sSX2nmQuSk7n8I4OVAyrI

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2behavioral3behavioral4