Derin Analiz - WinRAR SFX İtalyan Fatura Phishing | Tehdit: MEDIO
Archivo Kimligi
| SHA256 | 668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a |
|---|---|
| Tamaño | 1,270,246 byte PE32 WinRAR SFX arsivi |
| PDB | D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb |
| Hedef | Italya/Avrupa (Berner Group fatura sahteligi) |
Sosyal Muhendislik - Berner Group Fatura
PHISHING: Berner Group sirketi faturasi olarak gizlenmis WinRAR SFX dropper!
Sozde mesgru dosyalar (gostermelik):\n Fattura_Berner_1483470414_del 30.09.2025.PDF <- sahte fatura\n image002.jpg <- eklenti gorseli\n image003.png <- ek gorsel\n\nGercek kotu amacli yukler:\n PO_1072.exe <- Purchase Order (Satin Alma Emri) kiyafetli EXE\n Oct1.exe <- belirsiz EXE (ikinci asama yuk)\n\nSFX calistirma sirasi:\n Setup=image002.jpg <- once gorseli ac (dikkat dagit)\n Setup=image003.png <- ikinci gorsel\n Setup=PO_1072.exe <- asil yuku calistir\n Setup=Oct1.exe <- ikinci yuku calistir\n Overwrite=1 <- mevcut dosyalari uzerine yaz
Teknik Detaylar
WinRAR SFX PDB: D:\Projects\WinRAR\sfx\...\sfxzip.pdb\nSifreli: AES-0017 (WinRAR AES sifreleme)\nParola korumali arsiv\nCryptProtectMemory / CryptUnprotectMemory kullanimi\n\nKampanya tarihine gore: 30.09.2025 (Eylul 2025 kampanyasi)\nBerner Group: Almanya/Italya merkezli insaat araci ureticisi\n=> hedef kuruluslarin tedarik birimi calisan
IOC
| SHA256 | 668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a |
|---|---|
| Yuk | PO_1072.exe, Oct1.exe |
| Sahte | Fattura_Berner...30.09.2025.PDF |
| Sifreleme | AES-0017 (WinRAR) |
Lista IOC (1 indicadores)
IOC — WinRARSFXDropper
# SHA256
668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | 668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a |