Extracted

• • Target

    a8f1f11683ad9aab8d0a83878a46c71c_JaffaCakes118

  • Size

    284KB

  • MD5

    a8f1f11683ad9aab8d0a83878a46c71c

  • SHA1

    8205edf9bd85f684f3ab1a90f01be0ee70108a91

  • SHA256

    5ee1c44b9a5174e48cda267cbf38ef67971a520f521ce02395e152ed95e7c8ca

  • SHA512

    b06a0115b0cc35cf280d173bd52ec62dca1bbbdbb7b1e46f4ad5f758b4122e2a9d2cfb9fb84423f2358bada55d1459803107157be7b730588a396d87625774ab

  • SSDEEP

    6144:gdWy9iYZH+dGECyxpDRLgh6mXNdavy5m:gAobZH+dSyx9uh6m9wvy5

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2