Overview

overview

10

Static

static

52a729fa4f...e3.exe

windows7_x64

10

52a729fa4f...e3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    52a729fa4f6d62122027682058bb8722eb17adaf207bb4a1e9471537c85267e3

  • Size

    98KB

  • Sample

    210511-j7yv1qqvr6

  • MD5

    d5cf9f98ecc83ab402b1b975cc38203b

  • SHA1

    e2bffdab60e0bf9c5ef91dfeeb8f4a1b79b69e2e

  • SHA256

    52a729fa4f6d62122027682058bb8722eb17adaf207bb4a1e9471537c85267e3

  • SHA512

    8883e65feb95d955978e48a2c8dfc701eb371bdc7268e43e8aa3ea36e49939f4dea54333515ce6b4987169d39864ba05553f5b56c48ca4256d3fde42b8daa89b

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      52a729fa4f6d62122027682058bb8722eb17adaf207bb4a1e9471537c85267e3

    • Size

      98KB

    • MD5

      d5cf9f98ecc83ab402b1b975cc38203b

    • SHA1

      e2bffdab60e0bf9c5ef91dfeeb8f4a1b79b69e2e

    • SHA256

      52a729fa4f6d62122027682058bb8722eb17adaf207bb4a1e9471537c85267e3

    • SHA512

      8883e65feb95d955978e48a2c8dfc701eb371bdc7268e43e8aa3ea36e49939f4dea54333515ce6b4987169d39864ba05553f5b56c48ca4256d3fde42b8daa89b

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks