Overview

overview

10

Static

static

3

2025-03-30...er.exe

windows7-x64

10

2025-03-30...er.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-30_64867de072235cf392911dd2dd1c6209_amadey_rhadamanthys_smoke-loader

  • Size

    225KB

  • Sample

    250330-zdgwzawxax

  • MD5

    64867de072235cf392911dd2dd1c6209

  • SHA1

    b16a368485816fcf4f17fa2d955bd6c785de4a38

  • SHA256

    4ff15734c11b247a4c3fc7871e9a8bfd648d20b7c09438aca1b5f45fc52b0b86

  • SHA512

    e9078865d5af71a812169722d8caaffa04efe8f44bbbadf7a5900f8829741fed3e2ac64e7f3f4f29aa034779e7520a49b6cfaad57eb1b2ced88ec9abe2d05a06

  • SSDEEP

    6144:BA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:BATuTAnKGwUAW3ycQqgf

Score
10/10
tinbabankerdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      2025-03-30_64867de072235cf392911dd2dd1c6209_amadey_rhadamanthys_smoke-loader

    • Size

      225KB

    • MD5

      64867de072235cf392911dd2dd1c6209

    • SHA1

      b16a368485816fcf4f17fa2d955bd6c785de4a38

    • SHA256

      4ff15734c11b247a4c3fc7871e9a8bfd648d20b7c09438aca1b5f45fc52b0b86

    • SHA512

      e9078865d5af71a812169722d8caaffa04efe8f44bbbadf7a5900f8829741fed3e2ac64e7f3f4f29aa034779e7520a49b6cfaad57eb1b2ced88ec9abe2d05a06

    • SSDEEP

      6144:BA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:BATuTAnKGwUAW3ycQqgf

    Score
    10/10
    tinbabankerdiscoverypersistencetrojan

    • Tinba / TinyBanker

      Banking trojan which uses packet sniffing to steal data.

      trojanbankertinba

    • Tinba family

      tinba

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks