Overview

overview

10

Static

static

8ee8f7beee...a8.exe

windows7_x64

10

8ee8f7beee...a8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8

  • Size

    160KB

  • Sample

    210509-ahkm2hqhkj

  • MD5

    bb7975b2ba7ca271e5e75628c4f648ac

  • SHA1

    f9741d1c73c53c736fb19e51123f3325db5e9b32

  • SHA256

    8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8

  • SHA512

    3e73a69972d65dceeb44e01015fd4e3eb5abfce9d0029a2ce54d29248071690337e872de84a396e86291bc12f33ef7769b15f1c257dc87694dfaba21ee5f51bd

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8

    • Size

      160KB

    • MD5

      bb7975b2ba7ca271e5e75628c4f648ac

    • SHA1

      f9741d1c73c53c736fb19e51123f3325db5e9b32

    • SHA256

      8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8

    • SHA512

      3e73a69972d65dceeb44e01015fd4e3eb5abfce9d0029a2ce54d29248071690337e872de84a396e86291bc12f33ef7769b15f1c257dc87694dfaba21ee5f51bd

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks