Extracted

• • Target
    bd5e92e335c0bccfb3fd1d30153febaa
  • Size 376KB
  • SHA256 9298e3252c84af5631a95ba5174794beada8b746917c971459ad0bdedd91d4d8
  • MD5 bd5e92e335c0bccfb3fd1d30153febaa
  • SHA1 4e769223c6388321ab6cb5c71a130779c98fa468
  • SHA512 890d2e8b86771e15e6feac65f21458fe543f1fe49f156ae64155cfe61135ac35f92f66e21ba3827584f440645359a6a9b35f96af5461f38f9e5570a7b97224ef
  • SSDEEP 6144:tnCryGiAV3dhUcC5rXPRjWUyLYwl8bRgfmDnWpSSwmfk6LNuv+JQMz:Ir9iGthUcyXP9N4/l3fQTSRfnwv+JP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2