Extracted

• • Target

    JaffaCakes118_cb8ebd25f8838510e3e65ff24e988f86

  • Size

    409KB

  • MD5

    cb8ebd25f8838510e3e65ff24e988f86

  • SHA1

    a87c09ccbf33ac48b4d3d5ed6838bf5ec31074bd

  • SHA256

    86eea5405b09a3100a40691d3e2ad7b1d4f7a9f0796e14b8ecc5c381bc80d3ca

  • SHA512

    bcc256faf2c2b50b6d5b44a03129c9612e9aaf981aaf1abc3009ca30ba27a9936cf84ccdaa70ed2835204505d7c79ed4ba103f0c579c922d48cd01e96f9a28a4

  • SSDEEP

    12288:257Jh9ckVKXJnSWxrDyJUw0omE7YJacfB:2571wJnSWxrDyJtmHJ

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2