Overview

overview

10

Static

static

8cf1689d1d...3b.exe

windows7_x64

10

8cf1689d1d...3b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8cf1689d1d802f777b6298acd738912eec2a3133545fa8fdcea3779627ad543b

  • Size

    98KB

  • Sample

    210505-vxckgxfnax

  • MD5

    ef6e2d67f1d5415a4c1a89b004775f4e

  • SHA1

    2ddc6bb4691f51fa8596b18f3a9022020de26d73

  • SHA256

    8cf1689d1d802f777b6298acd738912eec2a3133545fa8fdcea3779627ad543b

  • SHA512

    c12d088a9164d03c6436651d6cce59aa6440fcaf97bed275c178f8b49d5f48cb01c05a77e84761010ab306417f40054a56390cc19b9c33aa9c909d2cc33419ce

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      8cf1689d1d802f777b6298acd738912eec2a3133545fa8fdcea3779627ad543b

    • Size

      98KB

    • MD5

      ef6e2d67f1d5415a4c1a89b004775f4e

    • SHA1

      2ddc6bb4691f51fa8596b18f3a9022020de26d73

    • SHA256

      8cf1689d1d802f777b6298acd738912eec2a3133545fa8fdcea3779627ad543b

    • SHA512

      c12d088a9164d03c6436651d6cce59aa6440fcaf97bed275c178f8b49d5f48cb01c05a77e84761010ab306417f40054a56390cc19b9c33aa9c909d2cc33419ce

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks