Extracted

• • Target

    JaffaCakes118_44a20c6259effbc4f8d19d3b9ad9e79e

  • Size

    444KB

  • MD5

    44a20c6259effbc4f8d19d3b9ad9e79e

  • SHA1

    170ad5ae18a3080f27ca66bae3cb5eaf4125e4d1

  • SHA256

    8df85de69eca57ba12d2044e751c655cef674fb84b9a78d0c3f48c7d71285eef

  • SHA512

    996009c1ca9ef758f0529645962c83b6ca9f603edf7fc43d7dcb844cc3698e67b82629f705c592714f297def233cdef73ffa7a94342d542a25ab4bc6bc645c8b

  • SSDEEP

    6144:AP4wNuvLiiCuTp96R6NIDCClmktNrKoHTR3RgBWSyj3L8cBzquus/fqQ3hQ/:AwUbvcr6wODCItNLthgWdj3L8Iks/SQ

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2