Extracted

• • Target

    7f660b3298f73735b2ed7872f1441ccd_JaffaCakes118

  • Size

    398KB

  • MD5

    7f660b3298f73735b2ed7872f1441ccd

  • SHA1

    91f1a81fc50b6de12a3d1f2c2979d8361257ffaf

  • SHA256

    c13ecbd3925ff79e202fa6a09e2dbab7efc52470e72d15e16aed8319767950f7

  • SHA512

    723194a9fe300d1606d51db8014e1444b0605d0d02cb990f292e878f1250f4bd8a748d1d2dc1759f73eebc3311ae696d9b7f34e6cc542f31b5c129e57e949dbf

  • SSDEEP

    6144:WNGIZN+uTOGcz91LArlBLwqTYwoIWUM0qJL6vOOhxxdeTr/ekI:TuTOX918RBLwgOIW9L6Tzxd6L

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2