Extracted

• • Target

    5b0a7253de15bf159141d624fea88528_JaffaCakes118

  • Size

    379KB

  • MD5

    5b0a7253de15bf159141d624fea88528

  • SHA1

    e9f9c12864ed0c7360bbe94760e5d1172e66d17d

  • SHA256

    fcfe0e26e945ba5fbde5d01cad9bcb66b2c9623bc8cdc627e9c886e32fde6134

  • SHA512

    677cd314a3c0b3b9e404d73b249ca4f507c5a55c4d005581f3662680757fe7aee723e13d74bcaac07f6a8dd02b91a0226100880732a9ab38a71395f693c4653f

  • SSDEEP

    6144:EMoDVV7WRRKZ/tDTuHHV2Y/IGwNLcW6g/AE/rPz9+X:gr7W3KDDTyV2yInJPz

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2