Ziraat Bankasi Swift Mesaji[.]exe

resource
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Ziraat Bankasi Swift Mesaji.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 434e8427b603739452b1c7a3eb2f8a4b5014fcbe088bed9d3192c6a7693f7a7e
MD5 ece0158c87eeca8bb29521283a4710ca
SHA1 35f1a493324308a3b3ea7d858aa20d06a1063b47
SHA512 9919c8b288f3f78d613663d3fff3e6d9379ead9efb7d58f6c6f4181555b69c78fa2ec4efc745f8cd518ffc37e415d4a9ffc36291bad6ee755583bfce3aa5e2dd
SSDEEP 12288:gl1vJDJKWFCm9lpkJNJh0FwRvrYZgin9mPiMHmCcdcwOU8ws8CYb7pjPDdtGzU4O:gl1vbKWt9lpkHv0vqikPFq2wOhwjr7p5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bf:6a:c9:70:93:02:80:58:b0:ea:fb:11:14:b2:98:69:d1:cf:12:6f:85:f5:7a:66:48:45:46:7b:bc:d5:2b:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Knotberry,OU=Hostessing Manufactural\ ,O=Knotberry,L=Buchen (Odenwald),ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c1e537573636570746962696c69746965734063617574656c6f75732e4c6576

Chains

Feb 7, 2024

Minor OS version

0

Major OS version

4

Entry point

12653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Agendaernes/bemrkning/metacoracoid.moo

SHA256 0d5232fb6b43acb41319bb8b40f35af0238674a3dfcc0f6162103ee8bb6425cf
MD5 82973e744b89081c186bda5efe6b4eef
SHA1 a736cedfc0a05c80a645e5c76b71288f211b2577
SHA512 7d4fb365be96663f3b3ac593a03f33e771232edb7d4380fd7faf99c6b588344121b53365fb83ff9699d0de60ab44d45a3f8609f49ba5009962b1772aa76eb2e9
SSDEEP 3072:4O8gTSSIADR7l7ppIJn/LPEjI2I6smechijGhh3JeTOEB9:4Or+WkFyKKhK9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Agendaernes/bemrkning/posekikkeris.blu

SHA256 2cb1db9035b8795e88322c08061a7967e801ab0437b2b08beb4ef3000ad81f39
MD5 05171ec7472eac523b22ea5639bccc59
SHA1 29e90159fadac8d3b0f6ff862a20779d4d4bc6d1
SHA512 239497390f532b8a422a73745eec7a4160ed991598b22faadc92a173fdf368ccbd611f8a1a8895c20b527dc7013ebd6a17ab35f32c7685d7d96ab49c43bffaef
SSDEEP 768:oEyCi/3RCxdaooeJiacnAgrNLMFlUPGKgnVwpJm:Jipgd9XA3CFWPLGwm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Lepid.Pre

SHA256 f98511d0cea41be5a8b99c3adc2213a2ccb7c9909070909ec8038e85bc606dfa
MD5 6ee4986a9fb3999e7b37fe3b0b69184f
SHA1 93ebac94eac1d0d71d9f9d476d4d24eff8757c1c
SHA512 14eec090e8f060bdcf19bf057c3a2456b3f22b4d342a416b689ddc4e4b26075719a6c2a23b617f8ea8abdba1d74815a4d3748c18705e4c2e3c8118df6ed4d4b5
SSDEEP 6144:L9xMKxWreLdJa9DqX+gE40CAdHimw9sqrpkZzyrzJ5:LBWqJa9Dq10CiinO6kZzyp5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

prinsernes/Decarboxylated/Homonymity/Splintres.div

SHA256 988c171769fdb17ee127e3207b08439905b328481110fc4e986c82b86a47cf17
MD5 d84d101d956dcaa912d18367b24eadcb
SHA1 9bc4b01d7536ee92775b0118e37eb0ad0763672c
SHA512 159f4cb662819cc9d8847e3bb7b583155a47f09c066be82c9485bd51f8111c66be44a4139a3ff784ccdef96938b051587c83baf0555676468e2be7b6f24c2e13
SSDEEP 1536:zinZwZXXUZPMxon+bnpOpVaI0rF6kDquIqYU7f8MhsdfKqSCg:zKG6PXn6pXZqDqvzcuCg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

prinsernes/Decarboxylated/Homonymity/gamest.txt

SHA256 f8e9889d60b90f3c00e7e83ef9eaa9773cd577b1da5f1c40849247b6582558f6
MD5 b89f823a8874799e8ea15005378a3110
SHA1 19803b07cac1c7c4df044ad171f29a5ddbe766e6
SHA512 15173f60bb09dcd6bc769d4b461786ee87680575ba157e6f2ce88258070a8072203e52e1c62db26300f761b0be62e23a8170dd9cac860e884a7ed3429f1b3cec
MD5 SHA1 SHA512

NSIS installer

installer

prinsernes/Decarboxylated/Homonymity/sphygmia.Kun

SHA256 f6ab5bcd82ffa72cde0cb083fe098a7be39cc015975b02094ce74333509beead
MD5 98edb98701b3fbc97d5ccf20fe9df955
SHA1 3ec855e8852c6b7a33221310162fe3804be0557f
SHA512 1afbdf3ddfcff785c90fba1b2923f32fde82c654aab7be5581051a2a5bfa55d3eb62cd97638767401085db4478280fdd17c926c451bfa20e40182ed7f523e4f8
SSDEEP 768:NWQKVALP5wdd7R7N4WjAiyuAjyhFtQmbJG9pz3E6wMJJB2r7wktbgMw2VLwAbkSF:NWpAzo5LNJ5JGfz3EAJ07w2VLwAQB4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer