tinba | 64c57af3b33cb8d8b3405a51802b66038f00b6e78394f3d2657fbcacb53a2c7e | Triage

Sharing

General

Target

64c57af3b33cb8d8b3405a51802b66038f00b6e78394f3d2657fbcacb53a2c7e
Size

225KB
Sample

240620-2r5aja1eke
MD5

171e8c57800b4d80392852b2885be6b8
SHA1

e20d1b6cb568a479c01b0dfcba8abee25b0b824c
SHA256

64c57af3b33cb8d8b3405a51802b66038f00b6e78394f3d2657fbcacb53a2c7e
SHA512

93315a1d1cb15280ecb52d4659826c3a68f40dc38f74f790b0b091a52887e9eec47ac35e1a9a5d4af7fabafe24b2ee03ee28412a9d521ac5ec1580a56b37cb79
SSDEEP

6144:bA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:bATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  64c57af3b33cb8d8b3405a51802b66038f00b6e78394f3d2657fbcacb53a2c7e
- Size
  
  225KB
- MD5
  
  171e8c57800b4d80392852b2885be6b8
- SHA1
  
  e20d1b6cb568a479c01b0dfcba8abee25b0b824c
- SHA256
  
  64c57af3b33cb8d8b3405a51802b66038f00b6e78394f3d2657fbcacb53a2c7e
- SHA512
  
  93315a1d1cb15280ecb52d4659826c3a68f40dc38f74f790b0b091a52887e9eec47ac35e1a9a5d4af7fabafe24b2ee03ee28412a9d521ac5ec1580a56b37cb79
- SSDEEP
  
  6144:bA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:bATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2