General
-
Target
Ziraat Bankasi Swift Mesaji.pdf.exe
-
Size
3.3MB
-
Sample
241101-x15kfasnbw
-
MD5
57597326a7df1d16bd6998b248e40707
-
SHA1
4c27df3928758ce9c618ab3d04ed5f77033ac060
-
SHA256
9a9e117db9ae2f94a250c13d9a6d03384e4011aaaca9cb28b92a136dee0dc53e
-
SHA512
9cf1073e92254e01860a0472f73aea6c016368b8b0a57fb6a17e8affc8f1de318ea9a5f9e128eebb6b32997d525b29d2a4d4264eb756336597c57f9f98997533
-
SSDEEP
12288:Zpss19tpgw6BCA+Y68X3GNyOidq7Letr3zr+8uCS:bs8Axx3HpEL2r3zr+aS
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.pdf.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Ziraat Bankasi Swift Mesaji.pdf.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Ziraat Bankasi Swift Mesaji.pdf.exe
-
Size
3.3MB
-
MD5
57597326a7df1d16bd6998b248e40707
-
SHA1
4c27df3928758ce9c618ab3d04ed5f77033ac060
-
SHA256
9a9e117db9ae2f94a250c13d9a6d03384e4011aaaca9cb28b92a136dee0dc53e
-
SHA512
9cf1073e92254e01860a0472f73aea6c016368b8b0a57fb6a17e8affc8f1de318ea9a5f9e128eebb6b32997d525b29d2a4d4264eb756336597c57f9f98997533
-
SSDEEP
12288:Zpss19tpgw6BCA+Y68X3GNyOidq7Letr3zr+8uCS:bs8Axx3HpEL2r3zr+aS
Score6/10-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-