Extracted

• • Target

    b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118

  • Size

    339KB

  • MD5

    b7d610ea84da74ede9f9dfeab88f8475

  • SHA1

    852d7c21e13e6fa5fc2a58941d926af734e02959

  • SHA256

    fa83eba7e3b3197c422823db67eb3ce509293eda358b29536cec627aa424865c

  • SHA512

    4f2270efc792598c1f21f0d44840ca6cdcfe7757a6e3d938db2e10689a216cbe5f49a32ec54ad416669a04d8ade92e38511533be90090d964f46df1adb16abfa

  • SSDEEP

    6144:6H79ve/t8CucAkoJNNABqA3dg23C5IPTOphn7B4FjKiSM+Xb:6H79veiCunjNctggCqqpd9UH7

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2