Overview

overview

10

Static

static

10

ecd3cef945...7d.exe

windows7-x64

10

ecd3cef945...7d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecd3cef94588edc92a329889d6486d8834d113dd9e8c354da8a808ed7abc8e7d

  • Size

    45KB

  • Sample

    240620-fqw2wavdnp

  • MD5

    4daff2e4e4f13a09d465a68754125431

  • SHA1

    3f926731096e27c0eeb90196b023c32e81377aa0

  • SHA256

    ecd3cef94588edc92a329889d6486d8834d113dd9e8c354da8a808ed7abc8e7d

  • SHA512

    200ddb19a811b78cb90c3b191dfb3550a5d0a7e0a9e10ce11ef851d3d640254ea05709d63d52e4dfcfbc2147d671295c63f8944aee722bb158c4aab8809189fb

  • SSDEEP

    768:3hP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:RsWE9N5dFu53dsniQaB/xZ14n7zIF+qr

Score
10/10
tinbabankerpersistencetrojanupx

Malware Config

Targets

    • Target

      ecd3cef94588edc92a329889d6486d8834d113dd9e8c354da8a808ed7abc8e7d

    • Size

      45KB

    • MD5

      4daff2e4e4f13a09d465a68754125431

    • SHA1

      3f926731096e27c0eeb90196b023c32e81377aa0

    • SHA256

      ecd3cef94588edc92a329889d6486d8834d113dd9e8c354da8a808ed7abc8e7d

    • SHA512

      200ddb19a811b78cb90c3b191dfb3550a5d0a7e0a9e10ce11ef851d3d640254ea05709d63d52e4dfcfbc2147d671295c63f8944aee722bb158c4aab8809189fb

    • SSDEEP

      768:3hP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:RsWE9N5dFu53dsniQaB/xZ14n7zIF+qr

    Score
    10/10
    tinbabankerpersistencetrojanupx

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • UPX dump on OEP (original entry point)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks