Extracted

• • Target

    fa9f2c2ac3880b8e36473957125095b9_JaffaCakes118

  • Size

    380KB

  • MD5

    fa9f2c2ac3880b8e36473957125095b9

  • SHA1

    14908426ff2b5b6ce7e655b52c1c7fbbd2b229e9

  • SHA256

    7d2a1db466bbc3c9d1b45211679756156953d1d8e68783d5d5bf0a33f08d5dc5

  • SHA512

    4a9a93f6bcc5621c098c2743f57b1e9a5b527a110db0cd6002ab46f606e4a7400734317eef51306c8ee5a9d68e7e96ecd8b036df2ef6a7879305ac63f3deeaec

  • SSDEEP

    6144:bdd/qv46YnuHiNeeu5ezICOO4kk9wwtZkdLc6P+q0Sn0zl19pDJO:D/sYnHNe55ezLOO4kbwtwbn0B19b

  Score

  10^/10

  gcleaneronlyloggervidarloaderstealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2