General

  • Target

    Ziraat Bankasi Swift Mesaji.pdf.exe

  • Size

    3.3MB

  • Sample

    241101-x15kfasnbw

  • MD5

    57597326a7df1d16bd6998b248e40707

  • SHA1

    4c27df3928758ce9c618ab3d04ed5f77033ac060

  • SHA256

    9a9e117db9ae2f94a250c13d9a6d03384e4011aaaca9cb28b92a136dee0dc53e

  • SHA512

    9cf1073e92254e01860a0472f73aea6c016368b8b0a57fb6a17e8affc8f1de318ea9a5f9e128eebb6b32997d525b29d2a4d4264eb756336597c57f9f98997533

  • SSDEEP

    12288:Zpss19tpgw6BCA+Y68X3GNyOidq7Letr3zr+8uCS:bs8Axx3HpEL2r3zr+aS

Score
6/10

Malware Config

Targets

    • Target

      Ziraat Bankasi Swift Mesaji.pdf.exe

    • Size

      3.3MB

    • MD5

      57597326a7df1d16bd6998b248e40707

    • SHA1

      4c27df3928758ce9c618ab3d04ed5f77033ac060

    • SHA256

      9a9e117db9ae2f94a250c13d9a6d03384e4011aaaca9cb28b92a136dee0dc53e

    • SHA512

      9cf1073e92254e01860a0472f73aea6c016368b8b0a57fb6a17e8affc8f1de318ea9a5f9e128eebb6b32997d525b29d2a4d4264eb756336597c57f9f98997533

    • SSDEEP

      12288:Zpss19tpgw6BCA+Y68X3GNyOidq7Letr3zr+8uCS:bs8Axx3HpEL2r3zr+aS

    Score
    6/10
    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks