Extracted

• • Target
    425b312c607eaa405059b4928a65cba8.exe
  • Size 420KB
  • SHA256 ea25dcf8f74b1d1094825d695807839f48230a800420cd2c57a05f7f6fe5a5bb
  • MD5 425b312c607eaa405059b4928a65cba8
  • SHA1 3caefbcad6d742e8c1849ec2d8ce092c0c75152f
  • SHA512 89d9c201da31815db48bbb0fea5268044a412dac91677f8d9fc9a7ff1b9eec9d0c8b3c864b340148a22cacbd6b2e3a37dbfd94170ccba3d059ee261c402d1fa6
  • SSDEEP 12288:hET5GSUENyq2QSfyrVVM6O83C1+ZOXzh:aTXUENRFlZVMusYOj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2behavioral3behavioral4