Extracted

• • Target

    12ff9b8180a4b96ed654499039e3f095_JaffaCakes118

  • Size

    410KB

  • MD5

    12ff9b8180a4b96ed654499039e3f095

  • SHA1

    83c62c3d8a72f380665d2f73a47c1522a399459e

  • SHA256

    48ebd939838da5d8bda510ebd8ff6ea17f593b81179fff93ed57089531b175e6

  • SHA512

    060abd8539d0c7be47b5d6b730be4c5a5248da38a36cd9be8c98cb13bd0a0b3ec364834de467f4d895f3e521d41c54771ca10a2c9e0d95030e962c6c5141ac4c

  • SSDEEP

    6144:ZHuPLzULqhKmWddRLkEuNZ+k5mS2Oxqw5/KtwqJL6uxOOOhxxdeTr/ekI:APvzhKmW7IRx2Of/CL6uCzxd6L

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2