Extracted

• • Target
    Ziraat Bankasi Swift Messaji.jse
  • Size 155KB
  • SHA256 fc78ff65e07439abeb5dda84cac5ed8e101984e56e01955f332b6fd11dfa0f8b
  • MD5 24fb9dd9be6f3fb961fb8ef1fc60e6b6
  • SHA1 979e1a4677cb42649c473e4888cddc0847e50ab2
  • SHA512 98d65c7a61ef4913f87f01e9ef915d27339679c654e505833113e2b3c4098f3aa72313e590b18d1713c20ae9322554fb9e08ba772e4bf5f4029b8d0a840da083
  • SSDEEP 3072:o3cZBnKzvdVbDqR+rjxR1xk85P0oZ7jPj0JMMk1Mi3LnNkkrqImr6pc1o7OGA6:cSKjdtnNkzrqcmbh
  • TLSH
    T11AF3124C56D1A44C03E7DB7A362E70D9F59A0CCA69C4844EE614F8D1F6F4706EEE0AB2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2