General

  • Target

    d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c

  • Size

    45KB

  • Sample

    240507-b2srdacf5z

  • MD5

    682bb5b985b9d76d1de5420035ead7bf

  • SHA1

    55e706096c13e43d4dd7ac3b09408f9e5da00ebd

  • SHA256

    d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c

  • SHA512

    c65113b18376db09780a5465de6c3841ba48008f7c8b8a2a4e64aafc616c5366a383e9a136377b981b4aa05fa64dae2930547d089cd95be95f4ecdc05150a0ef

  • SSDEEP

    768:QhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:ssWE9N5dFu53dsniQaB/xZ14n7zIF+qr

Malware Config

Targets

    • Target

      d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c

    • Size

      45KB

    • MD5

      682bb5b985b9d76d1de5420035ead7bf

    • SHA1

      55e706096c13e43d4dd7ac3b09408f9e5da00ebd

    • SHA256

      d3071d8e3154e4a2cc80b8ee8af3500a95a4684c80a516012efd44987b3ccb9c

    • SHA512

      c65113b18376db09780a5465de6c3841ba48008f7c8b8a2a4e64aafc616c5366a383e9a136377b981b4aa05fa64dae2930547d089cd95be95f4ecdc05150a0ef

    • SSDEEP

      768:QhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:ssWE9N5dFu53dsniQaB/xZ14n7zIF+qr

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

    • UPX dump on OEP (original entry point)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Tasks