Extracted

• • Target

    704bcc14bda5e69fd770adc5a2e376b6_JaffaCakes118

  • Size

    250KB

  • MD5

    704bcc14bda5e69fd770adc5a2e376b6

  • SHA1

    8cd5c010071f3e765513b13b64320c0ee861b887

  • SHA256

    053598a2e8eea3336dae45bd27c9f961278556ab76a90358fd6d0ed3cce6db83

  • SHA512

    7028ec414601486dfe3971e09c3e68ff8b929afee9c3af68ceb3f7f0038b889085308d5319dc73f160d32b43ac5e8d43ed231f2598e64d969302fc45b6e91b53

  • SSDEEP

    3072:hEZCdnZcL32HhxeLGTPJk5oQMN9mewSEn4RbK10MBY8ZGPdWCoS55vFvK:iCF2L32HhxeyTYe0SSsO19ZmHouc

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2