tinba | 1a39b013838c79bbdee8c203166d9c5348c0db3753dee906441fe3723634e685 | Triage

Sharing

General

Target

4da2e8c181ba6f84e13e5c01f983e640N.exe
Size

225KB
Sample

240726-yvs5ws1hnk
MD5

4da2e8c181ba6f84e13e5c01f983e640
SHA1

9aab92309210df03702a5953dffe8c701c885bd0
SHA256

1a39b013838c79bbdee8c203166d9c5348c0db3753dee906441fe3723634e685
SHA512

4dbacee5dd2750b7ab375e99d8db60f815dc07d8e741ea1c5ce8713ba08cffc7d48ccdacc43daceb3af3c9b0e2d36abd2bede8ee2aa7c521af4777ccae31d20b
SSDEEP

6144:9A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:9ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4da2e8c181ba6f84e13e5c01f983e640N.exe
- Size
  
  225KB
- MD5
  
  4da2e8c181ba6f84e13e5c01f983e640
- SHA1
  
  9aab92309210df03702a5953dffe8c701c885bd0
- SHA256
  
  1a39b013838c79bbdee8c203166d9c5348c0db3753dee906441fe3723634e685
- SHA512
  
  4dbacee5dd2750b7ab375e99d8db60f815dc07d8e741ea1c5ce8713ba08cffc7d48ccdacc43daceb3af3c9b0e2d36abd2bede8ee2aa7c521af4777ccae31d20b
- SSDEEP
  
  6144:9A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:9ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2