Overview

overview

10

Static

static

5174de9617...90.exe

windows7_x64

10

5174de9617...90.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5174de9617f906e11f9f19a5518667ff77bc97b4269dd5f3921efc16efdcb390

  • Size

    136KB

  • Sample

    210513-jxx9brdwlx

  • MD5

    bd3e7964eef52275ffb96b4b67abb521

  • SHA1

    16abe736e1df123bd763bdb0d424c9cffab03a10

  • SHA256

    5174de9617f906e11f9f19a5518667ff77bc97b4269dd5f3921efc16efdcb390

  • SHA512

    e33a4b26b86101cbbce3f32a829e1d53425bda510248dfdaafc25db812effa47e9eccb6d1d1fd642c36b27b76a3ae12b844c98d1d66cd515d85da90094413b44

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      5174de9617f906e11f9f19a5518667ff77bc97b4269dd5f3921efc16efdcb390

    • Size

      136KB

    • MD5

      bd3e7964eef52275ffb96b4b67abb521

    • SHA1

      16abe736e1df123bd763bdb0d424c9cffab03a10

    • SHA256

      5174de9617f906e11f9f19a5518667ff77bc97b4269dd5f3921efc16efdcb390

    • SHA512

      e33a4b26b86101cbbce3f32a829e1d53425bda510248dfdaafc25db812effa47e9eccb6d1d1fd642c36b27b76a3ae12b844c98d1d66cd515d85da90094413b44

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks