Extracted

• • Target

    177146ab9c1464d8a95b5ebf474c3fc7_JaffaCakes118

  • Size

    409KB

  • MD5

    177146ab9c1464d8a95b5ebf474c3fc7

  • SHA1

    dd583484d1c4a86d6eec6d2874a56a6deadfdbff

  • SHA256

    09c06c239ac278d132a8910c86f7e76d7b47848c77f80413f2efc4c93b9d3bce

  • SHA512

    a420d7aae9f732f311e229261c5671b2a89969ec0befeba09fd152aa46268ac868055b46c9e926f8a96c4769cbfaea9b34211057bf62fc8578394e4e1ff91717

  • SSDEEP

    6144:9KuPLzyLqhKpRWUiewZPyMnqOBHP4CdGx+SqJL6B/OOhxxdeTr/ekI:XPvphKpJ0PPB++L6Vzxd6L

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2