Extracted

• • Target

    0970b2e0391fe778c790d0c7ecb98d36def554fbfe1f3776b8cbf7f96eddc684.exe

  • Size

    332KB

  • MD5

    d8a65cfcfad34a96ec277ac0952b4d7e

  • SHA1

    4efebca2c304837e12bca351529f1963bc479799

  • SHA256

    0970b2e0391fe778c790d0c7ecb98d36def554fbfe1f3776b8cbf7f96eddc684

  • SHA512

    dd6253508c85ea897507d767fb65e00d813f816a2010e26c4c781f94b246c5d540b4b2591a93f51b31da34476b224e07e979a99349f42dbdeb4f708ea71f0f5f

  • SSDEEP

    6144:TBSTuWUckSbLG37/NG2ZO7nK/kgUaYJIpOok7+K5:TBSTuWUye37/HUnK/kp+u+Y

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2