Extracted

• • Target

    85594058d6aec062a3e49d27f9394cd4_JaffaCakes118

  • Size

    388KB

  • MD5

    85594058d6aec062a3e49d27f9394cd4

  • SHA1

    322b70c2acd7aeda7613b662500b7f221d63637a

  • SHA256

    35e22e58b668778663cde3619804d4e89f3c761fadde6bb0040a70a7b7b738a6

  • SHA512

    aab9ad90e1b07158cc0799e2e5ea70c26329468cd3b4775ecb17775547b962170a402791f99dd8186806f452ffc8acdb3f039e41b900fadf3072f1ab52349160

  • SSDEEP

    6144:AJLRdSr8GEL8hf7vIhOWjouV50n4emuoTCGYmz6huKhROhxxpeTr/ekI:ER/GeIghutmlCHWzxp6L

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2