Extracted

• • Target

    bd5e92e335c0bccfb3fd1d30153febaa

  • Size

    376KB

  • MD5

    bd5e92e335c0bccfb3fd1d30153febaa

  • SHA1

    4e769223c6388321ab6cb5c71a130779c98fa468

  • SHA256

    9298e3252c84af5631a95ba5174794beada8b746917c971459ad0bdedd91d4d8

  • SHA512

    890d2e8b86771e15e6feac65f21458fe543f1fe49f156ae64155cfe61135ac35f92f66e21ba3827584f440645359a6a9b35f96af5461f38f9e5570a7b97224ef

  • SSDEEP

    6144:tnCryGiAV3dhUcC5rXPRjWUyLYwl8bRgfmDnWpSSwmfk6LNuv+JQMz:Ir9iGthUcyXP9N4/l3fQTSRfnwv+JP

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2