Extracted

• • Target

    fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118

  • Size

    285KB

  • MD5

    fd6f2d6431adc8ab79ef69616b9b756a

  • SHA1

    061bf41849559a21f667cf4289ca5cd32fcca9da

  • SHA256

    d3cbcf7224c5cd688e665238b91e2b0249c175d6238af31398308e7ecb226cb9

  • SHA512

    a1521b76a706888d14c16a388995f75dd5422c4bb317a9887bced337dcf2f34217ca74a3ea0f350321f0b270e27fa021e8382a96b0d0cad1a4d9dec4bffdc19d

  • SSDEEP

    6144:iw2nNVPt9knkBGvINhmjVss4ocL4hL1NZh:iw2nNVnkndIn42hocknv

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2