Overview

overview

10

Static

static

cac8388836...12.exe

windows7_x64

10

cac8388836...12.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cac83888367ca377c018e55ee1df6eef7543976818fa55af17b3fec960eae612

  • Size

    98KB

  • Sample

    210511-s4j2hh42z6

  • MD5

    c84999af4257889363b320ec720c11c5

  • SHA1

    e1f1d7025c76337f3b7c557fd59b851a1a65e0ff

  • SHA256

    cac83888367ca377c018e55ee1df6eef7543976818fa55af17b3fec960eae612

  • SHA512

    2d5d97ad2e3f8d8687d0edb302dcb6a12d66de77dbd22f003d2a33f7fcbbda0d488ae39634da9ffb98cd8b934f40615ee35488a280bb7db518ed748e139d704e

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      cac83888367ca377c018e55ee1df6eef7543976818fa55af17b3fec960eae612

    • Size

      98KB

    • MD5

      c84999af4257889363b320ec720c11c5

    • SHA1

      e1f1d7025c76337f3b7c557fd59b851a1a65e0ff

    • SHA256

      cac83888367ca377c018e55ee1df6eef7543976818fa55af17b3fec960eae612

    • SHA512

      2d5d97ad2e3f8d8687d0edb302dcb6a12d66de77dbd22f003d2a33f7fcbbda0d488ae39634da9ffb98cd8b934f40615ee35488a280bb7db518ed748e139d704e

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks