tinba | 9cc8dc1c163875e9152475db7ae00776da044aee6c472c1c0ae515e16d17a20d | Triage

Sharing

General

Target

01cb20704592abca95432c5b5278be20N.exe
Size

237KB
Sample

240815-g15mfatfmr
MD5

01cb20704592abca95432c5b5278be20
SHA1

570318cd33fde27132c0d16f1cfa40e537c0a97c
SHA256

9cc8dc1c163875e9152475db7ae00776da044aee6c472c1c0ae515e16d17a20d
SHA512

f3391bfb3c460a0167f8b04c6db2949abfa83ca9bfecd5dc2b85835593fb76cd668e58f5ceb5ee186d2f94c297cf7c5b5d7658e4fb0a7a89f4a7ffc2b000084b
SSDEEP

6144:/A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:/ATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  01cb20704592abca95432c5b5278be20N.exe
- Size
  
  237KB
- MD5
  
  01cb20704592abca95432c5b5278be20
- SHA1
  
  570318cd33fde27132c0d16f1cfa40e537c0a97c
- SHA256
  
  9cc8dc1c163875e9152475db7ae00776da044aee6c472c1c0ae515e16d17a20d
- SHA512
  
  f3391bfb3c460a0167f8b04c6db2949abfa83ca9bfecd5dc2b85835593fb76cd668e58f5ceb5ee186d2f94c297cf7c5b5d7658e4fb0a7a89f4a7ffc2b000084b
- SSDEEP
  
  6144:/A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:/ATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2