Extracted

• • Target

    49a70d3437724bd70e25e097f8ea80fd.exe

  • Size

    450KB

  • MD5

    49a70d3437724bd70e25e097f8ea80fd

  • SHA1

    0f467a5bed2642302bb81f43d5fa825b0c72e402

  • SHA256

    2a77ae43cff20befca76b49de3665a059eadb01dd0a15cadd69eab65c2a7f491

  • SHA512

    0f8a0652a19aba5d4df32b2f7532d0a5952ef21d9f885a619df6de8e05dec3cbeec78df2e8e270d4d460bb3bb6798e522f64dbfd9ba439d034670ae4a8188b45

  • SSDEEP

    6144:x8aTDnsEzuiercYKh5GpMGDgnbGSA165LRHqliBAaXlYwyntuq89b+aQ:TzRzuiercYKq+GDgrACL9qsLqwFq06a

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2