Overview

overview

10

Static

static

3

0fe4698657...18.exe

windows7-x64

10

0fe4698657...18.exe

windows10-2004-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target

    0fe4698657dc7c60cf27898465620075_JaffaCakes118

  • Size

    98KB

  • Sample

    240503-hdwlpabc88

  • MD5

    0fe4698657dc7c60cf27898465620075

  • SHA1

    3afbb96110c3c3f428dc112b33d3c51d7f6bd3d8

  • SHA256

    d914331f4a69867c663401b41005a0b0600537939e2ed1c0a391e36b44481181

  • SHA512

    e3242a304a627250560ef734dcf8101076b1d489324fee3c0bc8242f1ce2055aa538591a1e7f5199757bb27c72918176ae627bd72d5d08e53c5ff1d3c4017e8f

  • SSDEEP

    3072:NML4O96w0G1+aL/B1M51UZhImhQxocfoGYURjqMa8D2cB:S8O96wt+e/BmoZhBv6jRj5pScB

Score
10/10
tinbabankerpersistencetrojan

Malware Config

Targets

    • Target

      0fe4698657dc7c60cf27898465620075_JaffaCakes118

    • Size

      98KB

    • MD5

      0fe4698657dc7c60cf27898465620075

    • SHA1

      3afbb96110c3c3f428dc112b33d3c51d7f6bd3d8

    • SHA256

      d914331f4a69867c663401b41005a0b0600537939e2ed1c0a391e36b44481181

    • SHA512

      e3242a304a627250560ef734dcf8101076b1d489324fee3c0bc8242f1ce2055aa538591a1e7f5199757bb27c72918176ae627bd72d5d08e53c5ff1d3c4017e8f

    • SSDEEP

      3072:NML4O96w0G1+aL/B1M51UZhImhQxocfoGYURjqMa8D2cB:S8O96wt+e/BmoZhBv6jRj5pScB

    Score
    10/10
    tinbabankerpersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks