Extracted

• • Target

    325ad9cb87d12330e7fc94507282f799_JaffaCakes118

  • Size

    249KB

  • MD5

    325ad9cb87d12330e7fc94507282f799

  • SHA1

    7e34a218700dcfc430a631cf64c72e9f0d2d39f7

  • SHA256

    bac663f2a8d3a67131c6098f1864cbdd03eacee21b66a20591980f01456cab30

  • SHA512

    47e75f47147dc919e808f70182decee3c3ee25391ad4a9672dc4fac88dbc80e684e53beba9afdb7946b019a6a623ab1f6012cba9265a178da52724cfa333a5e4

  • SSDEEP

    3072:T/rqmkcOfBKfyJHlfDrCz4lZv3tXzBJTUJhpxyDXcF04yp0X57+x:jdKwfyrDi4FzBJQtc0y2d+

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2