Overview

overview

10

Static

static

6861e6b7c0...e8.exe

windows7_x64

10

6861e6b7c0...e8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6861e6b7c03f754ad052a04c97eb555bfa00b10b01ca21b7dbda05c1f1cdece8

  • Size

    98KB

  • Sample

    210509-bc6f58xz6a

  • MD5

    e5f8e18811f8fcf4e6cb19d6352ad07f

  • SHA1

    cc6c0a517aecb5f4f5f9d5308f24fdaea605376d

  • SHA256

    6861e6b7c03f754ad052a04c97eb555bfa00b10b01ca21b7dbda05c1f1cdece8

  • SHA512

    8d11fd7ed1ef654866349b67c8358cff2f3422e8461cb0667001c3c7a7025033fba50d4834c80fc6eee9a031370d7c186fb6f85caff4697543876c7d4ae9c5fc

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      6861e6b7c03f754ad052a04c97eb555bfa00b10b01ca21b7dbda05c1f1cdece8

    • Size

      98KB

    • MD5

      e5f8e18811f8fcf4e6cb19d6352ad07f

    • SHA1

      cc6c0a517aecb5f4f5f9d5308f24fdaea605376d

    • SHA256

      6861e6b7c03f754ad052a04c97eb555bfa00b10b01ca21b7dbda05c1f1cdece8

    • SHA512

      8d11fd7ed1ef654866349b67c8358cff2f3422e8461cb0667001c3c7a7025033fba50d4834c80fc6eee9a031370d7c186fb6f85caff4697543876c7d4ae9c5fc

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks