Overview

overview

10

Static

static

81475bc2c9...4a.exe

windows7_x64

10

81475bc2c9...4a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81475bc2c9bfeb47b4fabb8048541a12adf7614fdb9a834c720ff1fb2451714a

  • Size

    136KB

  • Sample

    210508-r1pvlly986

  • MD5

    03f94835cbe4799ac4319e1eee9c407e

  • SHA1

    cc8f10801bb1113520db239e7654622be5a6d548

  • SHA256

    81475bc2c9bfeb47b4fabb8048541a12adf7614fdb9a834c720ff1fb2451714a

  • SHA512

    b469604f79ca5bb31ec25b937cf667dd8631ebd5381e1b4c2aa4ccb34ab326d7f85a6b05ff91f10545d211cb6ff640c10cb53bb4d28d4eb0618f0def92e9a3a2

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      81475bc2c9bfeb47b4fabb8048541a12adf7614fdb9a834c720ff1fb2451714a

    • Size

      136KB

    • MD5

      03f94835cbe4799ac4319e1eee9c407e

    • SHA1

      cc8f10801bb1113520db239e7654622be5a6d548

    • SHA256

      81475bc2c9bfeb47b4fabb8048541a12adf7614fdb9a834c720ff1fb2451714a

    • SHA512

      b469604f79ca5bb31ec25b937cf667dd8631ebd5381e1b4c2aa4ccb34ab326d7f85a6b05ff91f10545d211cb6ff640c10cb53bb4d28d4eb0618f0def92e9a3a2

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks