Extracted

• • Target

    8e6e835dede4156784b26cb01339f050_JaffaCakes118

  • Size

    252KB

  • MD5

    8e6e835dede4156784b26cb01339f050

  • SHA1

    d0f3846526cf7ed69b67301e419f72ce8ba981fd

  • SHA256

    8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762

  • SHA512

    05a4bda590b1d147aeb2a32b5c0c758700c585502083c003295b4ebe46927455e646b67b3570c11981441c3f90fb89e1441b72b7192755c8b8fa3efb50979516

  • SSDEEP

    6144:pIYAQk0weX2qSCpwv3+Ag/DomARu+Vd9Unv:CY3k2X2qJpC3PoX+VP

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2