Extracted

• • Target

    f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118

  • Size

    436KB

  • MD5

    f417a42407e03aa745b6eceeb4994b7c

  • SHA1

    33f6be92bc9cc096c4ed5f4a27b5da7fce790e8c

  • SHA256

    7c6528ddebf48f0199d66b42f5d38452c4665638c33d918392c4cb0b4dd4f24f

  • SHA512

    05201d549682963c9a77ec644fe1d860a3b3dbc54df09d2731492ce05e67bb7a4abc80dfe561808f1faae27a9a1e7a859bd2d1df4ea08237f11325b13d7c3cb5

  • SSDEEP

    12288:ZVYrj0c2rNKuY47UjZ5nW98tIAKbFK9mp6atb:gnNKNK/47M5nW9nAkKo5

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2