Extracted

• • Target

    26515120e283a959ae2076bbf0b93048_JaffaCakes118

  • Size

    383KB

  • MD5

    26515120e283a959ae2076bbf0b93048

  • SHA1

    33e339fce6d51584f78c849f6e9d754aa6c565b2

  • SHA256

    7c978fad574a7cd3d8559b5903e7b70fbcd890d06a86a851a3c0514a2db10bb8

  • SHA512

    bef21b38bb8ac6a7b45e5bc837138bedf2fda1e1f6d55fbed721b3e583e26ecbb44de440fc885a92bfaca8a6e7375090442dbc649d27af6fa1ec099a5bc79a6a

  • SSDEEP

    6144:bzZ8p0KIafZG+fHeDcsl+L2X82H8d2jgq3CtyYZPuvAk6fxUOs3vCCC:bK0KIy0U+Dcs8odtgt5hVf+Os3K

  Score

  10^/10

  gcleaneronlyloggerloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2