Extracted

• • Target
    7eaf66915da13fe8bc67ba6b10935b25
  • Size 277KB
  • SHA256 506fb8885b421c43d5e6886e689284d4a23e6cc5c4a42caea269b1259027354f
  • MD5 7eaf66915da13fe8bc67ba6b10935b25
  • SHA1 883490031a2c5cf4f65c54d7abcfe898c7b1e3df
  • SHA512 3f010e9abb6f8463c3bb6edd250951c4a3b3a79fd00958a3536bc1272729bc891d09ca7da1f30a0650f91372342d15836892b2a0ada2d2fca67f61f45710ca2c
  • SSDEEP 3072:2+wF1L6e7R3FrIBvslFjhCp6Gk3VfvozlOaXo6pEA8uD91HG048JQRzNnLBzgFnc:2XrR1kNMcyVfUYQrBRHBoNdgFnL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2