Extracted

• • Target

    829904d7b9a2352fcb43eb58a986eba3_JaffaCakes118

  • Size

    387KB

  • MD5

    829904d7b9a2352fcb43eb58a986eba3

  • SHA1

    5bd57bdac68fa0d740518e9efe40c983685f462e

  • SHA256

    43a87fd0bd1c72b0b0ee5460e688c65344677bcb451f90c74bc34b0492ce6159

  • SHA512

    b3c87fa4c8d57ae8e6ea1601c8a7beef39e302e51cdfe2d2f5297ef47149ee4ebf248701e34538d1530a655526d9ec93f1851f1abb8145be1bdd52b1a75c1cdf

  • SSDEEP

    12288:ogfusyU6qxYr231b4NZYZoOCPdD6AxJWv4:vfF5YYEOOD6Sf

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2