434e8427b603739452b1c7a3eb2f8a4b5014fcbe088bed9d3192c6a7693f7a7e

General

Target
Ziraat Bankasi Swift Mesaji.exe
Size 608KB
Sample240207-lkdw1agefl
SHA256 434e8427b603739452b1c7a3eb2f8a4b5014fcbe088bed9d3192c6a7693f7a7e
MD5 ece0158c87eeca8bb29521283a4710ca
SHA1 35f1a493324308a3b3ea7d858aa20d06a1063b47
SHA512 9919c8b288f3f78d613663d3fff3e6d9379ead9efb7d58f6c6f4181555b69c78fa2ec4efc745f8cd518ffc37e415d4a9ffc36291bad6ee755583bfce3aa5e2dd
SSDEEP 12288:gl1vJDJKWFCm9lpkJNJh0FwRvrYZgin9mPiMHmCcdcwOU8ws8CYb7pjPDdtGzU4O:gl1vbKWt9lpkHv0vqikPFq2wOhwjr7p5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Targets

- Target
  Ziraat Bankasi Swift Mesaji.exe
- Size 608KB
- SHA256 434e8427b603739452b1c7a3eb2f8a4b5014fcbe088bed9d3192c6a7693f7a7e
- MD5 ece0158c87eeca8bb29521283a4710ca
- SHA1 35f1a493324308a3b3ea7d858aa20d06a1063b47
- SHA512 9919c8b288f3f78d613663d3fff3e6d9379ead9efb7d58f6c6f4181555b69c78fa2ec4efc745f8cd518ffc37e415d4a9ffc36291bad6ee755583bfce3aa5e2dd
- SSDEEP 12288:gl1vJDJKWFCm9lpkJNJh0FwRvrYZgin9mPiMHmCcdcwOU8ws8CYb7pjPDdtGzU4O:gl1vbKWt9lpkHv0vqikPFq2wOhwjr7p5
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
- MD5 b5a1f9dc73e2944a388a61411bdd8c70
- SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
- SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
- SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  prinsernes/Decarboxylated/Homonymity/sphygmia.Kun
- Size 44KB
- SHA256 f6ab5bcd82ffa72cde0cb083fe098a7be39cc015975b02094ce74333509beead
- MD5 98edb98701b3fbc97d5ccf20fe9df955
- SHA1 3ec855e8852c6b7a33221310162fe3804be0557f
- SHA512 1afbdf3ddfcff785c90fba1b2923f32fde82c654aab7be5581051a2a5bfa55d3eb62cd97638767401085db4478280fdd17c926c451bfa20e40182ed7f523e4f8
- SSDEEP 768:NWQKVALP5wdd7R7N4WjAiyuAjyhFtQmbJG9pz3E6wMJJB2r7wktbgMw2VLwAbkSF:NWpAzo5LNJ5JGfz3EAJ07w2VLwAQB4
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6