Extracted

• • Target
    bef3b5b031d54620d8ea232e0ceeefc8
  • Size 363KB
  • SHA256 260b02ef8e2926b9957ca91ca3a2c1d30178a9cb096c5835ff57bcdf75028810
  • MD5 bef3b5b031d54620d8ea232e0ceeefc8
  • SHA1 fa4b6282112c8c16bef3fed1bf1f25cf98c41a1e
  • SHA512 61503da98efbe34311e4846bbdd1d6d04804659e0b49e28965feafa8757992e8640509aeb44c901069e922cd6ed18681b947f9ee498fc352f9f46e3fc65c407c
  • SSDEEP 6144:b9cyVvxgfOm/oeVNpIDrsNAdly51yPIM04Qe2YD2K6Q/IytSvn:aivW2m/bpIDrsWdU7cIMrQvQwytS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2