Extracted

• • Target

    9e9c55bfd3fffddf9d71b8f73d1b7a19

  • Size

    369KB

  • MD5

    9e9c55bfd3fffddf9d71b8f73d1b7a19

  • SHA1

    e61e9ca729abb852de46bd47e86b047a581476db

  • SHA256

    13348c6ff4d140d0f1a196319b3393cbc8d4dc704dbc5ad919b9a09bc0c4a4b6

  • SHA512

    c62952a7c372b961542e4348e1fa6c98305bad2db4699dc9e371d2043caf205c86eccfad0bf41984b3837e4e72e91670e8e15091849d574e3299c7028ec1cce0

  • SSDEEP

    6144:/jZty/dizp4cFbA44iRFlDj36N8fCBVyTcYuitVShVGDPhxSz:ltsdizecFbVRFFmWfqVauiWHGDPbq

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2