Extracted

• • Target

    6244ed13512a21b23867d705d80bb4fa_JaffaCakes118

  • Size

    383KB

  • MD5

    6244ed13512a21b23867d705d80bb4fa

  • SHA1

    5b3705ff2130ddd63a312a09ac6e3111e7e41f10

  • SHA256

    cbcd57dd83369317946567dba9624dedbf2ce33acc796b2ba6f4c57b7d3cf49a

  • SHA512

    bd6bd18562e7b0fafa2dd4eb43865215a9a57788200bd61c3b9bb01171c287db1d7080d77d6f994e11cf3bffeacd43ef069e41e7695aa25a1faf7c45ab33d72c

  • SSDEEP

    6144:JuKPDM0nqwyEuBR+4KkhuJrIYG8wh5XB2QFe2z3gecF:TPg0nqwyLBRphuyAwPR2/43Bk

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2