General

  • Target

    Ziraat Bankasi Swift Mesaji.pdf.exe

  • Size

    413KB

  • Sample

    240122-l1nfdadgak

  • MD5

    bfa3832346460edd9e3c6d500ff362c5

  • SHA1

    215cf2e028db2fbb1a85bad4f9ee4159c33058c8

  • SHA256

    5de5eefbec6be9cf392e7dde9cf48df6e20e8b7896f311519b0713976ae6674f

  • SHA512

    912f85704f046fc156df3b00e962c8eaa0f7850af9fa658d029677e09649a22468999297fb54caef04477062342d17655518163093229ed0a652c1520cc7b93a

  • SSDEEP

    6144:84t6Lsvq5WSBH/AijRpRaVxLr5Ec/4JhgKwpXcW5og6cjmSlJeM:8kvqcSBHYibK1Os4JhgKycpcCoJL

Malware Config

Targets

    • Target

      Ziraat Bankasi Swift Mesaji.pdf.exe

    • Size

      413KB

    • MD5

      bfa3832346460edd9e3c6d500ff362c5

    • SHA1

      215cf2e028db2fbb1a85bad4f9ee4159c33058c8

    • SHA256

      5de5eefbec6be9cf392e7dde9cf48df6e20e8b7896f311519b0713976ae6674f

    • SHA512

      912f85704f046fc156df3b00e962c8eaa0f7850af9fa658d029677e09649a22468999297fb54caef04477062342d17655518163093229ed0a652c1520cc7b93a

    • SSDEEP

      6144:84t6Lsvq5WSBH/AijRpRaVxLr5Ec/4JhgKwpXcW5og6cjmSlJeM:8kvqcSBHYibK1Os4JhgKycpcCoJL

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      17ed1c86bd67e78ade4712be48a7d2bd

    • SHA1

      1cc9fe86d6d6030b4dae45ecddce5907991c01a0

    • SHA256

      bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

    • SHA512

      0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

    • SSDEEP

      192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      42b064366f780c1f298fa3cb3aeae260

    • SHA1

      5b0349db73c43f35227b252b9aa6555f5ede9015

    • SHA256

      c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab

    • SHA512

      50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7

    • SSDEEP

      192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      b55f7f1b17c39018910c23108f929082

    • SHA1

      1601f1cc0d0d6bcf35799b7cd15550cd01556172

    • SHA256

      c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7

    • SHA512

      d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa

    • SSDEEP

      96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN

    Score
    3/10
    • Target

      Tvangfrit/Udiciplineredes/Skttedes/Tushed/megapode.app

    • Size

      15KB

    • MD5

      6e941ea97a92ac8ee4ac713c354c58f6

    • SHA1

      3f23f03bf6547b2bf4b8a6eb00777a55aaf999ce

    • SHA256

      a3a45b243179f04a923e01a8f360aafa9d628b32354453f08c0b1c31797a534b

    • SHA512

      d2b43f6cf6d7e74c1053416213fcc35c30ca029c0c2f34de9553ad2adb92b923daf83611ba9b7b9d905ad1e60c53434dcd7ea58d3c0bf47ffa8b0e59b6cea489

    • SSDEEP

      384:U5FKcGSrXmxrPAn8EFGftXcMOxFILjA1BoLSw9QVN/Nr:IFUAYDEwftXcMkujKo6/Nr

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks