Overview

overview

10

Static

static

39ce987867...df.exe

windows7_x64

10

39ce987867...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39ce9878670c5630279c33472e27dd3dc3e7e377ec2e61ece73525eee54d16df

  • Size

    98KB

  • Sample

    210513-gpadcbxpq6

  • MD5

    0903876ea92fbf10bc29e9e38de861e4

  • SHA1

    9ec840f0bbe9665779a0760c79c6f39682362eab

  • SHA256

    39ce9878670c5630279c33472e27dd3dc3e7e377ec2e61ece73525eee54d16df

  • SHA512

    a61b62126259a73894a67ddc15f9a9580d74efb36d0b4767cd5502635d675fb60eeb16ae554f4fabcced6c5c7fd83ce8e5fd74ca4cbcd318698acd0265e405db

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      39ce9878670c5630279c33472e27dd3dc3e7e377ec2e61ece73525eee54d16df

    • Size

      98KB

    • MD5

      0903876ea92fbf10bc29e9e38de861e4

    • SHA1

      9ec840f0bbe9665779a0760c79c6f39682362eab

    • SHA256

      39ce9878670c5630279c33472e27dd3dc3e7e377ec2e61ece73525eee54d16df

    • SHA512

      a61b62126259a73894a67ddc15f9a9580d74efb36d0b4767cd5502635d675fb60eeb16ae554f4fabcced6c5c7fd83ce8e5fd74ca4cbcd318698acd0265e405db

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks