General

  • Target

    c6c4e893bc429bd99568a3e93a5f4c9d44c2dbb4b47b91f23adcc7caed73b7fc

  • Size

    40KB

  • Sample

    221126-l9gzyshe39

  • MD5

    b88022bd23c0203a15998a4815b159d7

  • SHA1

    61c3a2d0391d64d00ad77c246d6081582cd31440

  • SHA256

    c6c4e893bc429bd99568a3e93a5f4c9d44c2dbb4b47b91f23adcc7caed73b7fc

  • SHA512

    7a13f83c279d0de9535c14860ab5c94df68d9b63f090dd48761a5fe1934f9fb24932ff1f8eba5426df4976bc8af9faaa3e36b9d6d87fd0052551648e0b3901d3

  • SSDEEP

    768:qGbjzEBYfFJCgr67e5ytnjiw0OP4tjsPK+bUBsjsqN:Nb+eEg95ytrgjSK+bU2YI

Malware Config

Targets

    • Target

      c6c4e893bc429bd99568a3e93a5f4c9d44c2dbb4b47b91f23adcc7caed73b7fc

    • Size

      40KB

    • MD5

      b88022bd23c0203a15998a4815b159d7

    • SHA1

      61c3a2d0391d64d00ad77c246d6081582cd31440

    • SHA256

      c6c4e893bc429bd99568a3e93a5f4c9d44c2dbb4b47b91f23adcc7caed73b7fc

    • SHA512

      7a13f83c279d0de9535c14860ab5c94df68d9b63f090dd48761a5fe1934f9fb24932ff1f8eba5426df4976bc8af9faaa3e36b9d6d87fd0052551648e0b3901d3

    • SSDEEP

      768:qGbjzEBYfFJCgr67e5ytnjiw0OP4tjsPK+bUBsjsqN:Nb+eEg95ytrgjSK+bU2YI

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks