tinba | d3ea12e5d7764dc1633de610a34922c75682430f72b1f8e142dba3b36e64775b | Triage

Sharing

General

Target

d3ea12e5d7764dc1633de610a34922c75682430f72b1f8e142dba3b36e64775b
Size

225KB
Sample

240609-msad8ahe5w
MD5

f56e6e8bd9649f1eb38eab046b7f7165
SHA1

764ddca4ce7032f09efc9f9ed495460d502d74b5
SHA256

d3ea12e5d7764dc1633de610a34922c75682430f72b1f8e142dba3b36e64775b
SHA512

dac71e0de3b068b04dd777880587dd39004d6b34453b8dd224c817064d1288850ecf2b328b038577a085781ad625b4e6b0184155232b6e2384bfac35f2a5ebcc
SSDEEP

6144:6A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:6ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  d3ea12e5d7764dc1633de610a34922c75682430f72b1f8e142dba3b36e64775b
- Size
  
  225KB
- MD5
  
  f56e6e8bd9649f1eb38eab046b7f7165
- SHA1
  
  764ddca4ce7032f09efc9f9ed495460d502d74b5
- SHA256
  
  d3ea12e5d7764dc1633de610a34922c75682430f72b1f8e142dba3b36e64775b
- SHA512
  
  dac71e0de3b068b04dd777880587dd39004d6b34453b8dd224c817064d1288850ecf2b328b038577a085781ad625b4e6b0184155232b6e2384bfac35f2a5ebcc
- SSDEEP
  
  6144:6A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:6ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2