Extracted

• • Target

    JaffaCakes118_d8e69e65eefc5b003caf51dcc157647d

  • Size

    390KB

  • MD5

    d8e69e65eefc5b003caf51dcc157647d

  • SHA1

    2874519b8716f29bbb024ad7cd5d9c6dd7f9cbfe

  • SHA256

    f32d44862384367401e6c557229cdb1503f2459d81fcaf7ed071ad6a74b80012

  • SHA512

    2b4309d0cfa9ce4e67ebe1531f3ea35cfd21e55e3ae594bd33b707beae844fdfef82bb5fc8421daf5cc80cec336158f2ffa261476606d1155ffa700264b1b24d

  • SSDEEP

    12288:YhvGvuuooNGbcsByIo5arCvwZGEX8cA0/M:YkvuuVDmyIoYr9sEv

  Score

  10^/10

  gcleaneronlyloggerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • OnlyLogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2