Extracted

• • Target

    a2ab0049e01ee781efbb04400e10fab5

  • Size

    374KB

  • MD5

    a2ab0049e01ee781efbb04400e10fab5

  • SHA1

    f436e25008900beecd2e9315e2c25064424fa1f6

  • SHA256

    b18ba32fede23de87419e2c65fc5588dd95c50db76ec35aec2312ca54e6fc1db

  • SHA512

    ec48c25abfe2ede667e5204d6a66f790516cc3182905984c45164a350ac66d2023d6b5b714ace948b953a8dbba08ba21d675dec63aeda01d953ddf01d1778126

  • SSDEEP

    6144:PP1iUPxejt4EBaONQ4mlRjHmIxAdMQ3FxQ6W7DCTI/2043QEJ+BGh85pA:lnPkZlBSlRjGIxNQbQV7D0ZVQc2Ge5

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2