Extracted

• • Target

    4627cc7a8efa641992b35e467b5352b9_JaffaCakes118

  • Size

    398KB

  • MD5

    4627cc7a8efa641992b35e467b5352b9

  • SHA1

    aa1820a250038565e356946934aa462e400da53a

  • SHA256

    6828b9d506d4ebece654b79050798e70bea948ff5c017ce06c673ee464c7a990

  • SHA512

    9e19e978dd619a856499f4625e6809ec1d2b8e11df8f08f16dd4efde8bc2ff576774b48436f16df9a0460915037e53216611c46ec5a4ba1d5af497282fc549a5

  • SSDEEP

    6144:b0JIZDyLev6ghkpc0jWW9/78epUpYeGnpyqJL638wOOhxxdeTr/ekI:7yLev6gL0b/YOgYdn1L6Tzxd6L

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2