tinba | 9a1e94151c9cfbe5ad761a2a666dacfcb2d7c4ab31c9a5ce436376e046499d84 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9a1e94151c9cfbe5ad761a2a666dacfcb2d7c4ab31c9a5ce436376e046499d84
Size

250KB
Sample

240425-bexf2scf4z
MD5

e301b784d1b0de364699ecb9c2c59c1a
SHA1

a343994b3dfd8b1875e8a41660556c69fb3a9f20
SHA256

9a1e94151c9cfbe5ad761a2a666dacfcb2d7c4ab31c9a5ce436376e046499d84
SHA512

4d9bc3ede41fe89798558d615bdd06248175f87f387f33385f41d8b1a474cefd712b114928051c4fa178dad8a71111ee7031cbf2df5072773f8901b3489b27b4
SSDEEP

6144:HmkLu0Aqur8q7XMaC4+yPY7HLgZl3MovMfCp5C6:GkLsqur8q7Xp27rk3MoF

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  9a1e94151c9cfbe5ad761a2a666dacfcb2d7c4ab31c9a5ce436376e046499d84
- Size
  
  250KB
- MD5
  
  e301b784d1b0de364699ecb9c2c59c1a
- SHA1
  
  a343994b3dfd8b1875e8a41660556c69fb3a9f20
- SHA256
  
  9a1e94151c9cfbe5ad761a2a666dacfcb2d7c4ab31c9a5ce436376e046499d84
- SHA512
  
  4d9bc3ede41fe89798558d615bdd06248175f87f387f33385f41d8b1a474cefd712b114928051c4fa178dad8a71111ee7031cbf2df5072773f8901b3489b27b4
- SSDEEP
  
  6144:HmkLu0Aqur8q7XMaC4+yPY7HLgZl3MovMfCp5C6:GkLsqur8q7Xp27rk3MoF
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2