Extracted

• • Target

    2faa2fb291f71756412f6d3a7b64d1d11d93b18b66aa1d7007960361e97848bf.exe

  • Size

    444KB

  • MD5

    0ca5761b2cd8f4a1d3a6172bcb40c2d6

  • SHA1

    1c81699a6fff3c6b5ee0e9457f73a9d7640d6292

  • SHA256

    2faa2fb291f71756412f6d3a7b64d1d11d93b18b66aa1d7007960361e97848bf

  • SHA512

    3c4897953666c46f10dc9ff3dbcfed6c1e7ba647b763d72946513622fcdfa6da6d35c0b099322c23efe98837695759fd2d367d77f1883b0f3ca3ed39d7017168

  • SSDEEP

    12288:blvgaJnWq36kMw03CPctkuGhAjeZMYJgiIUaf:bnJWq36kMTffjUMYmnf

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2