2 identical “Hesap hareketleriniz” emails contain the same r01 attachment, inside which there is an exe file: the malware. Stolen data is exfiltrated via Telegram API.
The Newsletter is sent on Saturday morning and contains news from the current week. You can select the one with all the contents, or by category. To stay up to date, however, we recommend that you follow the site every day or our pages on social networks.