Extracted

• • Target

    5326f1a18bdef318d330e01b6c12e3d0_JaffaCakes118

  • Size

    339KB

  • MD5

    5326f1a18bdef318d330e01b6c12e3d0

  • SHA1

    081efe3c4989cccb6d8c88ae0e1e8793ca028a05

  • SHA256

    9ec1d249fece00d7b3429ce1d589f27a13470f2d157c0e99f18f5b331a8276c9

  • SHA512

    36f10f7a8f69b6918b15f0371db75614a7bd57e393f4d1316f2cf031ae6fa9ee0b6c4619af99f548e01e92f937bbf153d621c5c2fbcb923f0bccadcce84a6c75

  • SSDEEP

    6144:M2PfPb/tT7x/jwuxEHBvFqU49JDDVVxoMAuimEu75Pf:M2PfPbFV/1uHbl4fDDDxJAuHVZ

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2