tinba | 9ecd6945095a31341e55bf45ebbec061714a9cdbdb4dac3478b1d673458a67df | Triage

Sharing

General

Target

0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe
Size

44KB
Sample

240617-24dckssdnl
MD5

0db543eb6303a474b1011164df96a480
SHA1

40eec54c64cf443e00c4b93ce20516f62e94faf1
SHA256

9ecd6945095a31341e55bf45ebbec061714a9cdbdb4dac3478b1d673458a67df
SHA512

1f2fc42ec2723836f1d21e8b8f0b3437889b3194ee4c9f26cd9f373fd7a520f2164b6dfcb5601f003ca48f0421c2ca1e98c18debb7edbaf4b4bfe14227b59ff8
SSDEEP

768:F3u9+vWm9aIbisNVEK2c28bpM2dBOsRxIVSJRwBlc:Fe9matCeUHUVSJRG

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe
- Size
  
  44KB
- MD5
  
  0db543eb6303a474b1011164df96a480
- SHA1
  
  40eec54c64cf443e00c4b93ce20516f62e94faf1
- SHA256
  
  9ecd6945095a31341e55bf45ebbec061714a9cdbdb4dac3478b1d673458a67df
- SHA512
  
  1f2fc42ec2723836f1d21e8b8f0b3437889b3194ee4c9f26cd9f373fd7a520f2164b6dfcb5601f003ca48f0421c2ca1e98c18debb7edbaf4b4bfe14227b59ff8
- SSDEEP
  
  768:F3u9+vWm9aIbisNVEK2c28bpM2dBOsRxIVSJRwBlc:Fe9matCeUHUVSJRG
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2