tinba | 49fd87eb13c0773f3e50d5cf4a18938c3a1a36fcd6768b193b061e37390513b9 | Triage

Sharing

General

Target

6886b964f5242f6f99d65f0bbd6ff660N.exe
Size

225KB
Sample

240719-hr9epsxgrn
MD5

6886b964f5242f6f99d65f0bbd6ff660
SHA1

95056aa9c77ca91f64a31425f2c80766961b523d
SHA256

49fd87eb13c0773f3e50d5cf4a18938c3a1a36fcd6768b193b061e37390513b9
SHA512

ea667e9187d90a544e4df2262b500201c52e3ce0e7b23d91a99403723287d91ee8571a92e0ce4b6b04ecce37cadde1cc26ee01b7f748d5d5b2332c59918d41de
SSDEEP

6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  6886b964f5242f6f99d65f0bbd6ff660N.exe
- Size
  
  225KB
- MD5
  
  6886b964f5242f6f99d65f0bbd6ff660
- SHA1
  
  95056aa9c77ca91f64a31425f2c80766961b523d
- SHA256
  
  49fd87eb13c0773f3e50d5cf4a18938c3a1a36fcd6768b193b061e37390513b9
- SHA512
  
  ea667e9187d90a544e4df2262b500201c52e3ce0e7b23d91a99403723287d91ee8571a92e0ce4b6b04ecce37cadde1cc26ee01b7f748d5d5b2332c59918d41de
- SSDEEP
  
  6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2