Extracted

• • Target

    fc5df9cbeea519f832bf5c8b5ee27921_JaffaCakes118

  • Size

    307KB

  • MD5

    fc5df9cbeea519f832bf5c8b5ee27921

  • SHA1

    76ab90d7c8245cafc8c4a396e46bec2afa4a7703

  • SHA256

    538117752938d0986ec171e98c3eda481128de3d688d41bb6cb2402010adf8bf

  • SHA512

    48a4d12830bcbcf18e4374f8dcbd0e374c4f400b2a88a084fc76eb7bdf52b987560dfc6ec13a29e2f916a7e1923b8c1a553806f3a83026c8ea239605001ad706

  • SSDEEP

    6144:eQa7ph/cUAprL7shrKn5Ht3e1/iPtA4zBRIz8iy57:e7VdcUAprL7she5N37FdYQ7

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2