Extracted

• • Target

    9acb03ff49f8917ae3d985f83f4dc97e_JaffaCakes118

  • Size

    385KB

  • MD5

    9acb03ff49f8917ae3d985f83f4dc97e

  • SHA1

    be15eadc65334095a590ca1df0150b2007b89c55

  • SHA256

    57ffddbb441a4ef819f4f6024ea6aeb42017e2a4e997db04475b3088a4bc0767

  • SHA512

    6ba2c1875f3247737d5fedf76e72ba05cfcb20bd574b37a076cd89b0dfcd847f9b48a12cfa9ff56c5aea7c35f1d0d88dbda160d799583986c348b4047aa002d9

  • SSDEEP

    12288:glIeRbKUgLS1YjJuIm5XnbfICT8VnU/6Br0:q/g21coMCTWUO

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2