Extracted

• • Target

    9cfac4002ec8a607d46108caa006db5c_JaffaCakes118

  • Size

    304KB

  • MD5

    9cfac4002ec8a607d46108caa006db5c

  • SHA1

    ef2d2a47958214f9a5516952e2ac16a9dc520182

  • SHA256

    9e1a644207c2a07ac139facaabcd917251dd8f4c206fc6410123cb94a1ba0f2f

  • SHA512

    8090fe20ef6138004d3ff72dd645f29d8d36224cb4dcd9d1c2031ce479e0d13adafca1a5d079c4bf5ce063a820c060f40319f9e0b9aade62f35a1de70f65bff9

  • SSDEEP

    6144:zAJ3TFCjXZdswk4STHak9Dnu7vHWj/LgnFJDAVx98aCdNE:0J3TKXswk/THx9z+vVkH8

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2