Overview

overview

10

Static

static

1da0c9939d...1e.exe

windows7_x64

10

1da0c9939d...1e.exe

windows10_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e

  • Size

    98KB

  • Sample

    210511-9vmpk58pva

  • MD5

    ea01dcd803b0b6de2878f1486d532f6e

  • SHA1

    581e56a7e8a44441a52707445929513a2f994591

  • SHA256

    1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e

  • SHA512

    59631ee3a3c95964619dcce1f2110979045e363630f639ac96fd47fa3f24b0965c3ed224682bfea8ea43bb0566c3eef0eb330f06c80027ff8e96ba25a9597d53

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e

    • Size

      98KB

    • MD5

      ea01dcd803b0b6de2878f1486d532f6e

    • SHA1

      581e56a7e8a44441a52707445929513a2f994591

    • SHA256

      1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e

    • SHA512

      59631ee3a3c95964619dcce1f2110979045e363630f639ac96fd47fa3f24b0965c3ed224682bfea8ea43bb0566c3eef0eb330f06c80027ff8e96ba25a9597d53

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks