Extracted

• • Target

    bef3b5b031d54620d8ea232e0ceeefc8

  • Size

    363KB

  • MD5

    bef3b5b031d54620d8ea232e0ceeefc8

  • SHA1

    fa4b6282112c8c16bef3fed1bf1f25cf98c41a1e

  • SHA256

    260b02ef8e2926b9957ca91ca3a2c1d30178a9cb096c5835ff57bcdf75028810

  • SHA512

    61503da98efbe34311e4846bbdd1d6d04804659e0b49e28965feafa8757992e8640509aeb44c901069e922cd6ed18681b947f9ee498fc352f9f46e3fc65c407c

  • SSDEEP

    6144:b9cyVvxgfOm/oeVNpIDrsNAdly51yPIM04Qe2YD2K6Q/IytSvn:aivW2m/bpIDrsWdU7cIMrQvQwytS

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2