Extracted

• • Target

    JaffaCakes118_01462017cae5db103b27c864ef145b7c

  • Size

    400KB

  • MD5

    01462017cae5db103b27c864ef145b7c

  • SHA1

    526586e175b3e6c9def0f47c58a27e3e051eaef5

  • SHA256

    82aa048783354378ad2b8c0f5f1747d9ffe477f5e02d3a32733aa02d65be1d77

  • SHA512

    940d1c2a1d1f1741bb53f7a33d3bea5a972257860d57ff4f9de047ef540277d6cf44792c6223db0d22a52eea695f5d7e83c0b5567161fd7c88455fc0a703ebc1

  • SSDEEP

    12288:FxYlQL+Ltuy1GYmHGSicXdB0pKBIp7P3nF:FxYSDy1GYmHfbX31+l

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2