Extracted

• • Target

    aacb56be73f8c1dfbfc9f9420b6f33e6

  • Size

    378KB

  • MD5

    aacb56be73f8c1dfbfc9f9420b6f33e6

  • SHA1

    0a20c05858fa72ca784312761716587a16539f85

  • SHA256

    1f33ed4af1d7f3ecf6c30b85c6183ca62254924888d44a5f1fccaed57be90616

  • SHA512

    9917c88312f151f6540c818eb971d716f9a3879c47364240ffee660c495ff9684883696561b262fcafba2fe4a3adc89233ff74eb3e1d25ff37ee6608c1bca620

  • SSDEEP

    6144:qWRJsaINHBYhJ/QBrqfUjj1EP3b/yqEfqHK8ib4eVhAvckGzV:fCaoHShOBufc5CbaEK8ib4MkeV

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2