General

  • Target

    Ödeme-20230130.pdf.exe

  • Size

    717KB

  • Sample

    230130-pradyaac84

  • MD5

    22d0a1e594cae70a0bb0c9d7382251bb

  • SHA1

    0e7dac977e320d06579ad1e4171d2a5b32639be0

  • SHA256

    7ecc0fccd1cef94795ada4dfcd7f03426b589c0abcc5a1a2979232c4df47d9ff

  • SHA512

    e446333c65f6614b792e17bdb14a2e184b006c5d9bdd4298410764abce39825bdca0c29afc084dbc8df6eb2cd37321f152cac69f904ba619daa1439c4a5cc188

  • SSDEEP

    12288:okDowLu7Q29jKCC4mXLHJK4DkLMWeh3ih9HEA:oUowUF9WCC4mXLH0OkLMBYT9

Malware Config

Targets

    • Target

      Ödeme-20230130.pdf.exe

    • Size

      717KB

    • MD5

      22d0a1e594cae70a0bb0c9d7382251bb

    • SHA1

      0e7dac977e320d06579ad1e4171d2a5b32639be0

    • SHA256

      7ecc0fccd1cef94795ada4dfcd7f03426b589c0abcc5a1a2979232c4df47d9ff

    • SHA512

      e446333c65f6614b792e17bdb14a2e184b006c5d9bdd4298410764abce39825bdca0c29afc084dbc8df6eb2cd37321f152cac69f904ba619daa1439c4a5cc188

    • SSDEEP

      12288:okDowLu7Q29jKCC4mXLHJK4DkLMWeh3ih9HEA:oUowUF9WCC4mXLH0OkLMBYT9

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks