Extracted

• • Target

    JaffaCakes118_6a52bc5eb7167b1b9388750a87a37459

  • Size

    444KB

  • MD5

    6a52bc5eb7167b1b9388750a87a37459

  • SHA1

    08eee7cd20b0bb9d1097357a8bcc877be72c6010

  • SHA256

    29fc9e60d4b92944739c3cef4ad4bb781d4ef4549c1f49a2d33e940bd0f6c62d

  • SHA512

    e3155809ded9a013f7388650a0be5cd2a02d5286287fadaf541aea89926cef68ec0167dd6bdb28634c098c91b7bab3908960ff4eef6efd8b97508f955d05c376

  • SSDEEP

    12288:efdgTBtlvcWmxZ1S9nTQD6erx3fuwBdCnkNTDevWh:eFg9tcXS9cxPuJnkZD

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2