Extracted

• • Target

    5ac515cf1fb2ab700146569f59c4e4bf_JaffaCakes118

  • Size

    421KB

  • MD5

    5ac515cf1fb2ab700146569f59c4e4bf

  • SHA1

    e0cc0be1e1e9f4e8a14acecc43aeefd84631d53e

  • SHA256

    d7e4b3b4affb5fb8b91a843bd26b2b453856641557c32ab27674af85dede2c3c

  • SHA512

    79229706b50b725f050e7de7f95d44f61f2536097809d6088b6e86dc57e5f232af48306cc4ade4acc5c38b8bf7db0c47c652b067d72d20891363087b0a133256

  • SSDEEP

    6144:tIAXJoFTiRL/AKU+Mwq4lk0VfDjLCwt6e0ZGOEhnCszkFmTzbhiqbof0va0:ZXJoga+84dbjew0e0zEhnCsYFohiqba

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2