tinba | 8d8a373d5df45d92ed5a8d259b0a9c3617ee62ef0f5bd7e2d2931113617978b5 | Triage

Sharing

General

Target

8d8a373d5df45d92ed5a8d259b0a9c3617ee62ef0f5bd7e2d2931113617978b5
Size

225KB
Sample

240708-besg4axclh
MD5

15346c0ed3c1b9044f2a7a9e8a104891
SHA1

d3032f7edf80c738df0b398f85cd013e1b7f18d0
SHA256

8d8a373d5df45d92ed5a8d259b0a9c3617ee62ef0f5bd7e2d2931113617978b5
SHA512

d46959b818bef0bf4e0971f645355e880ad7f54b7b0fe2e07ba0901a6a83e30aa13c8bf8f91145bc5b3ee90f65963810620af074b59fe1a068b7502fcf565699
SSDEEP

6144:zA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:zATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  8d8a373d5df45d92ed5a8d259b0a9c3617ee62ef0f5bd7e2d2931113617978b5
- Size
  
  225KB
- MD5
  
  15346c0ed3c1b9044f2a7a9e8a104891
- SHA1
  
  d3032f7edf80c738df0b398f85cd013e1b7f18d0
- SHA256
  
  8d8a373d5df45d92ed5a8d259b0a9c3617ee62ef0f5bd7e2d2931113617978b5
- SHA512
  
  d46959b818bef0bf4e0971f645355e880ad7f54b7b0fe2e07ba0901a6a83e30aa13c8bf8f91145bc5b3ee90f65963810620af074b59fe1a068b7502fcf565699
- SSDEEP
  
  6144:zA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:zATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2