Extracted

• • Target

    2edcd0c2c3446b523cce8723b67848b6_JaffaCakes118

  • Size

    366KB

  • MD5

    2edcd0c2c3446b523cce8723b67848b6

  • SHA1

    21d3c4aa74093d9dbf6ba46fba1c8b47ed2496fa

  • SHA256

    832bb287721c9ba37770ea80ae5ace489cb868ea655d022d88db12fb64106ea1

  • SHA512

    64868171ad9559269de920fa17628ba4ae3186d7a17785c8e26780af1d548bc5162d44e4aa0e0aae77509e360ee9e7d6144417f799fa2adebbabe7664c2b4d9b

  • SSDEEP

    3072:5SDHgmih2MkG1/0mbEjqfgl42J4yzkISZd484RuvhGDFWTyZ4TbSAWyTdV/3ZyzJ:SMkW7U4yz6yi/7td8rhaWWCIwnv5

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2