tinba | 4adf0ff3598bd05419b2504cc2641628d17e9b62eb009a7161a45a1a1e322697 | Triage

Sharing

General

Target

4adf0ff3598bd05419b2504cc2641628d17e9b62eb009a7161a45a1a1e322697
Size

237KB
Sample

240808-zwmvyatdja
MD5

a2e740c3d047e345544c691cb0b7cca4
SHA1

10685e691c69709290b6f1cf4705e71d7c745739
SHA256

4adf0ff3598bd05419b2504cc2641628d17e9b62eb009a7161a45a1a1e322697
SHA512

12bdce12a11e871e81494d550ff227918b56bd2a5ece2f761b439f011c033a8d268221e8ad38b1af5e5b2c5953fa843e60790dca7d4f015857002c66aa6e9833
SSDEEP

6144:ZA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:ZATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4adf0ff3598bd05419b2504cc2641628d17e9b62eb009a7161a45a1a1e322697
- Size
  
  237KB
- MD5
  
  a2e740c3d047e345544c691cb0b7cca4
- SHA1
  
  10685e691c69709290b6f1cf4705e71d7c745739
- SHA256
  
  4adf0ff3598bd05419b2504cc2641628d17e9b62eb009a7161a45a1a1e322697
- SHA512
  
  12bdce12a11e871e81494d550ff227918b56bd2a5ece2f761b439f011c033a8d268221e8ad38b1af5e5b2c5953fa843e60790dca7d4f015857002c66aa6e9833
- SSDEEP
  
  6144:ZA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:ZATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2