Extracted

Extracted

• • Target

    2ab67006fad0b7b4e8fb6496e221a529_JaffaCakes118

  • Size

    4.4MB

  • MD5

    2ab67006fad0b7b4e8fb6496e221a529

  • SHA1

    47f849e72bd7d203755775eebef19e1efa71ee19

  • SHA256

    5cb7dc8f48821f9e1f48c9d2d52f0f8e435c1286e5e0df3551f614deccdc47dc

  • SHA512

    a6ed4b8ae46d5bfdc802054c8ca428500473d29a736e1277c9654c6dfa2ae481a9e5fe0c505e0be0beddc86f880d0212483014968f41e5d93c15190877b16452

  • SSDEEP

    98304:HnGhGTPqSqfA0kWqa+5RmaH9ieepOs6435I58hsNcA5Pa:mBI02a+5gageepOs6435I58hS

  Score

  10^/10

  gcleaneronlyloggersocelarsdiscoveryloaderstealerspyware

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Drops Chrome extension

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2