Extracted

• • Target

    5d33584d5dfa1eb57d4b5915d7b5c86e_JaffaCakes118

  • Size

    1.4MB

  • MD5

    5d33584d5dfa1eb57d4b5915d7b5c86e

  • SHA1

    1333239d95ae4eb3d95b8ef1a77a67eaa373cd88

  • SHA256

    5e2feff937da52c7caa0ee241a71d7d032866ebab913e3fd83028051a020c9ad

  • SHA512

    560e887867c56bf53987bee5738fe659d21869ee4f9b41c352b28403e4ea5dfa007ccebcb6ccff329e9c5adf396976da8bfe4945d656e3c27c9bca176f71fc86

  • SSDEEP

    24576:G1e9yBNlug9312KoVPsT6npmwhw042QgWQqY:h9sNQSYKoVkT6n4whwL2QgWi

  Score

  10^/10

  discoverygcleaneronlyloggerxmrigloaderminer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • OnlyLogger payload

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2