Overview

overview

10

Static

static

de81c2c568...c8.exe

windows7_x64

10

de81c2c568...c8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8

  • Size

    152KB

  • Sample

    210513-grmebknhax

  • MD5

    bdf959504b5f4c4200e834929244b77b

  • SHA1

    5e802ffa9f31ed6eb20d0ead8795394b3003ff8c

  • SHA256

    de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8

  • SHA512

    028ea7463870901f73cb012dfc8210e567395dc3845f1952dbe41fc975157e3d24e8cbbc621b04c00361245181f10fe409a12b8c9979808b34a3026cbccff552

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8

    • Size

      152KB

    • MD5

      bdf959504b5f4c4200e834929244b77b

    • SHA1

      5e802ffa9f31ed6eb20d0ead8795394b3003ff8c

    • SHA256

      de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8

    • SHA512

      028ea7463870901f73cb012dfc8210e567395dc3845f1952dbe41fc975157e3d24e8cbbc621b04c00361245181f10fe409a12b8c9979808b34a3026cbccff552

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks