tinba | dd4a3c695cf0158c5f190093285754fdc8fefe6b6b532d9aeaa88f343db5d4b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dd4a3c695cf0158c5f190093285754fdc8fefe6b6b532d9aeaa88f343db5d4b7
Size

225KB
Sample

240320-bqbcysdg6y
MD5

c834de44e766ed87dd7abb8e27eb34c2
SHA1

96f1f37cf9318f11ead728ba965b653a1d5baeec
SHA256

dd4a3c695cf0158c5f190093285754fdc8fefe6b6b532d9aeaa88f343db5d4b7
SHA512

a715fa1da397145962376c4ca2f7ad3bdcb4097a5912b4c946b9f0a80d60e0f9e6432ee11621b27370da5826d790115772a813d74d3d036303b8b1b1e4fb09dc
SSDEEP

6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  dd4a3c695cf0158c5f190093285754fdc8fefe6b6b532d9aeaa88f343db5d4b7
- Size
  
  225KB
- MD5
  
  c834de44e766ed87dd7abb8e27eb34c2
- SHA1
  
  96f1f37cf9318f11ead728ba965b653a1d5baeec
- SHA256
  
  dd4a3c695cf0158c5f190093285754fdc8fefe6b6b532d9aeaa88f343db5d4b7
- SHA512
  
  a715fa1da397145962376c4ca2f7ad3bdcb4097a5912b4c946b9f0a80d60e0f9e6432ee11621b27370da5826d790115772a813d74d3d036303b8b1b1e4fb09dc
- SSDEEP
  
  6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2