Extracted

• • Target

    ef785714c6502ab3b553733b332e0be6_JaffaCakes118

  • Size

    381KB

  • MD5

    ef785714c6502ab3b553733b332e0be6

  • SHA1

    725374526c57b1732c3fb0e97ab947d3487e1797

  • SHA256

    a3d91ee98b9508917914bd31090532ccb90269fff015e6957189cf174d0a03b5

  • SHA512

    bd09432466ecf40ffe9dfd18845262a582a67c832bed06a8ec29bbb03b112d9eb8170b27bb65b8235c2dc0d32c6bffa5cdcd97ad4edd007d3e58f699ae18ba6a

  • SSDEEP

    6144:UTlnPMLbcIcgpaGIIfQs9TJ2NL8XjGciS6YpePZ+qAJVaTJtROhxxpeTr/ekI:elEcIcuaGIIf99I8zGciMkPZ+/YJKzxo

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2