Extracted

• • Target

    30bb260d24c69dd20180eb51b2eefedf_JaffaCakes118

  • Size

    344KB

  • MD5

    30bb260d24c69dd20180eb51b2eefedf

  • SHA1

    e0a35655e97b814fc2efb95b2bed1205224c630f

  • SHA256

    c770abd9fa7f04375a458c22042779316046e2e802821d16c122666965286235

  • SHA512

    d4bab593647b4083a940f135db2ade3c71a23e9cad3828f7c1026a080c6a2c4f7f337f9ba0ee0cb011d8de8019a4ad36418dbba73c157cd9d39b98fcb05b6dd7

  • SSDEEP

    6144:2O4V+4jforJ8jU8qmfExySXqJL6XOOhxxdeTr/ekI:K+ISX6Ex7IL6bzxd6L

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2