Extracted

• • Target

    24b3f3ce1ad3547d531330d65d27292e_JaffaCakes118

  • Size

    337KB

  • MD5

    24b3f3ce1ad3547d531330d65d27292e

  • SHA1

    631342516182094bcfe3c57b0cc254f042b6b2d3

  • SHA256

    3d6115e8c6be1cfcd600eebaa0b16c5943896fb0f45e66cee3ec71c38c53439d

  • SHA512

    05add7126941b56f7392ef731a169c9ecfa0c277db404858c1fe1e9249d9c425694217c9f6456f6b2ca1b6034bafd307dc4e783037aa5a518bbd4fc11e8aa9c5

  • SSDEEP

    6144:7eJnFeYbW1ZTsLs0ZCihb12VkKOStr9jC0ZZm51/0jsqC59fofSlg:7SF/bqZmZckktRjZG51su9oqlg

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2