Overview

overview

10

Static

static

73b82bf5ee...9b.exe

windows7_x64

10

73b82bf5ee...9b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b

  • Size

    98KB

  • Sample

    210508-pkhq61mwn2

  • MD5

    cfb0c225c8c8da011cfebcc5d4572612

  • SHA1

    51e7348adf6ec378fcaaf09effda78cc32f11ff4

  • SHA256

    73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b

  • SHA512

    2294e69281b5822e52c2b56b50fda51863c43426dfe2aec836281d648188a8452da3e46810fd4710803dafb21d3e1dcf4729265aa06f4a1d8eb7c05d9ebea659

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b

    • Size

      98KB

    • MD5

      cfb0c225c8c8da011cfebcc5d4572612

    • SHA1

      51e7348adf6ec378fcaaf09effda78cc32f11ff4

    • SHA256

      73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b

    • SHA512

      2294e69281b5822e52c2b56b50fda51863c43426dfe2aec836281d648188a8452da3e46810fd4710803dafb21d3e1dcf4729265aa06f4a1d8eb7c05d9ebea659

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks