tinba | f5a43a827f34e8a6e99d2e41e7ba1bbe50d6ebaae382a83d4b3451e8ca2759e8 | Triage

Sharing

General

Target

f5a43a827f34e8a6e99d2e41e7ba1bbe50d6ebaae382a83d4b3451e8ca2759e8
Size

225KB
Sample

240622-fgtkdsyflf
MD5

00cbce90b3935f58724ed6815ccbdece
SHA1

ae82db98cb0ef6d3cae0d78735c6f47329c85553
SHA256

f5a43a827f34e8a6e99d2e41e7ba1bbe50d6ebaae382a83d4b3451e8ca2759e8
SHA512

fe79baea0fc743b64b90425af24878003a817628866d01e857110b588aa912beaca48c561bc5ec8cc0cf2d99cd10fe86f21843f17f779a29d4ec7d0073c92f50
SSDEEP

6144:bA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:bATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  f5a43a827f34e8a6e99d2e41e7ba1bbe50d6ebaae382a83d4b3451e8ca2759e8
- Size
  
  225KB
- MD5
  
  00cbce90b3935f58724ed6815ccbdece
- SHA1
  
  ae82db98cb0ef6d3cae0d78735c6f47329c85553
- SHA256
  
  f5a43a827f34e8a6e99d2e41e7ba1bbe50d6ebaae382a83d4b3451e8ca2759e8
- SHA512
  
  fe79baea0fc743b64b90425af24878003a817628866d01e857110b588aa912beaca48c561bc5ec8cc0cf2d99cd10fe86f21843f17f779a29d4ec7d0073c92f50
- SSDEEP
  
  6144:bA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:bATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2