Extracted

• • Target

    JaffaCakes118_41028752ad94dc4206e7532332bb4b5a

  • Size

    432KB

  • MD5

    41028752ad94dc4206e7532332bb4b5a

  • SHA1

    f7bb7ebb3667f4b748252529402f96df43b5de41

  • SHA256

    9382b14d05294e88954bc799f7cbf86f98959c60ffa06f0e02dedad5d7230c49

  • SHA512

    3697f029b9b6f36655d1f3ced5efdff3e855801d65eadf97ad686edd77898bb42b58f211ea21cd3c612e46778308998edbb4f748362704bfa97a3aa81cce9e77

  • SSDEEP

    6144:ZU+m2xF9/rN4+QlMMzb4t9jNtfnMptCrqKYJV9x0YiqE1Kefq2PzFEWbItp38JV/:Z2IP0ct9LMp0rqKYtXTg/q2rFx6MJ

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2