Extracted

• • Target

    2b7eb734363ad47b73fcfeb5d7e7ec5a_JaffaCakes118

  • Size

    398KB

  • MD5

    2b7eb734363ad47b73fcfeb5d7e7ec5a

  • SHA1

    54dc5409a06798848413f263486316e8947ed657

  • SHA256

    3a37b8cf55a83dd9fab4550f6a83522a4995dd365112c651c9cfd700ec9cbb06

  • SHA512

    a9879489976c4657f8900e61309a5ada953487d44ebc25b9d50a7b428c452f3533a4dac26d7432eb069bbb9f7cfc1ba12fa0f986c378e24932a7df37ef51bf01

  • SSDEEP

    6144:+fGIZnKPiSiEQaJOTACiPjctDWgBBTcsV09Jb3PtDqJL65BOOhxxdeTr/ekI:OKPi9EQa4wPjeKgDov9l3CL67zxd6L

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2