tinba | 74614bfb11da5c25f3758dd57bf1d5b08d1d1f7a8afbfcd722eb8dfb0fb784ca | Triage

Sharing

Copy URL Twitter E-mail

General

Target

74614bfb11da5c25f3758dd57bf1d5b08d1d1f7a8afbfcd722eb8dfb0fb784ca
Size

225KB
Sample

240628-21q49svbje
MD5

3c1f5eb39bcb75b9483108c0896f0e4b
SHA1

d01cb7e77670601dbae83535a0382780dac91358
SHA256

74614bfb11da5c25f3758dd57bf1d5b08d1d1f7a8afbfcd722eb8dfb0fb784ca
SHA512

99f420f463526b2eb3d8fb9c6dd1b156ac4382751783c0a84d6df7302b419d2a58d5c5f5a5bab6d1b158e22cd3f6f8fa83036bc657a06dacb5af5a9422abcec8
SSDEEP

6144:EA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:EATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  74614bfb11da5c25f3758dd57bf1d5b08d1d1f7a8afbfcd722eb8dfb0fb784ca
- Size
  
  225KB
- MD5
  
  3c1f5eb39bcb75b9483108c0896f0e4b
- SHA1
  
  d01cb7e77670601dbae83535a0382780dac91358
- SHA256
  
  74614bfb11da5c25f3758dd57bf1d5b08d1d1f7a8afbfcd722eb8dfb0fb784ca
- SHA512
  
  99f420f463526b2eb3d8fb9c6dd1b156ac4382751783c0a84d6df7302b419d2a58d5c5f5a5bab6d1b158e22cd3f6f8fa83036bc657a06dacb5af5a9422abcec8
- SSDEEP
  
  6144:EA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:EATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2