Overview

overview

10

Static

static

dbea4f5cec...db.exe

windows7_x64

10

dbea4f5cec...db.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db

  • Size

    136KB

  • Sample

    210509-tzvh46bcsj

  • MD5

    faba908f3d962f72a9b4d6cae9bf762c

  • SHA1

    a80e57f10fcf285616f10b391e8719724f520cf3

  • SHA256

    dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db

  • SHA512

    a352593d471b822949220b269db76610b453d680dc36779c534767e34db8aed4d4bddeaa192db7423dbc58ff1562c556b0d59672882a0040fae4eca7b41b327c

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db

    • Size

      136KB

    • MD5

      faba908f3d962f72a9b4d6cae9bf762c

    • SHA1

      a80e57f10fcf285616f10b391e8719724f520cf3

    • SHA256

      dbea4f5cecf1acf52c23182cada6f16cef4c550a862ac4253eae1446e149e1db

    • SHA512

      a352593d471b822949220b269db76610b453d680dc36779c534767e34db8aed4d4bddeaa192db7423dbc58ff1562c556b0d59672882a0040fae4eca7b41b327c

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks