Extracted

• • Target

    730e7b84bba8c5d59fdaeb8fa620c28b_JaffaCakes118

  • Size

    270KB

  • MD5

    730e7b84bba8c5d59fdaeb8fa620c28b

  • SHA1

    486b630ce2932b02539cf5da1550bed9b0e9b8e7

  • SHA256

    6980a17e4ce556285dc2bb59c16a85bcfe839efa39e799c5766c23c692ea5ff7

  • SHA512

    236d83bc140d255681391487a26247039a628a32c75e4616a97a1c3394f487a63a45764fb25856e6206c541517470a0206bbae9128613c09a1f548fd980d777b

  • SSDEEP

    3072:/s+bpj8S8VN3FXV71NzOh8S3ngr8tts2KXLAykW5l1uN2NPeArywoOLi6://8S2Vl7qWS3grZ9XLxn1usNPeRwoOL

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2