tinba | 0def1a87472f2d3e633407e031256f0fa5df2d550a46db954eb4b67e2fb28349 | Triage

Sharing

General

Target

0def1a87472f2d3e633407e031256f0fa5df2d550a46db954eb4b67e2fb28349_NeikiAnalytics.exe
Size

89KB
Sample

240619-1p5b3stblc
MD5

68566b294db6b1c61436e54f4f6b1280
SHA1

6ca1bae1c02d08f1ac81f756caa82f2688a08beb
SHA256

0def1a87472f2d3e633407e031256f0fa5df2d550a46db954eb4b67e2fb28349
SHA512

9d72a04e57db14e349955abb531350a964a232e97fc77001599b04836a7343af3458988648fcda7df3ee3e475a51d59943e7f52bbfe9f9d1760c02ef8d3ac071
SSDEEP

1536:k9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:k9o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  0def1a87472f2d3e633407e031256f0fa5df2d550a46db954eb4b67e2fb28349_NeikiAnalytics.exe
- Size
  
  89KB
- MD5
  
  68566b294db6b1c61436e54f4f6b1280
- SHA1
  
  6ca1bae1c02d08f1ac81f756caa82f2688a08beb
- SHA256
  
  0def1a87472f2d3e633407e031256f0fa5df2d550a46db954eb4b67e2fb28349
- SHA512
  
  9d72a04e57db14e349955abb531350a964a232e97fc77001599b04836a7343af3458988648fcda7df3ee3e475a51d59943e7f52bbfe9f9d1760c02ef8d3ac071
- SSDEEP
  
  1536:k9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:k9o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2

tinbabankerpersistencetrojan