Extracted

• • Target

    5cc843ec28f5f4b15bf2e7e3e95ad54d_JaffaCakes118

  • Size

    281KB

  • MD5

    5cc843ec28f5f4b15bf2e7e3e95ad54d

  • SHA1

    7f8f587b2a18f801b48ebb182854056a505c7f2e

  • SHA256

    8947301e85623e30300e9094eb2dad7f325660419362c223dba601de5bd9e3c4

  • SHA512

    dc6e05e0d1b583f8c89f54cc28582f904e196c48919e0c91480c69a5809f0efcdf2a0a16371779693a8915d91b0fd0ccf78d17799a09f32cae6c2c2a999333f5

  • SSDEEP

    6144:jRSqB6PTCV6/+quQKkZhif29yXTaBTVngQ6lTL5SO:v6PWV6/+qe8hmghTnV3O

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2