tinba | 3e5bfe0ca8f353e91e3f84bff969a9490e5edc381a96213a83d717f3dcfb9591 | Triage

Sharing

General

Target

35bb48e85b36f11fbf5fd42845983ce0N.exe
Size

225KB
Sample

240816-2prxessaqb
MD5

35bb48e85b36f11fbf5fd42845983ce0
SHA1

7ce9b5e1bdd166dcf0cc4545854f47ab5e2cb976
SHA256

3e5bfe0ca8f353e91e3f84bff969a9490e5edc381a96213a83d717f3dcfb9591
SHA512

40bd015aac479d902e9fc86acc38006b8cbacbf7c9dcd4a57643ce3d9bdb0102aef129fd89828f3666d79290322951239c3b5c8967bbf242424ef6b9471d08ef
SSDEEP

6144:AA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:AATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  35bb48e85b36f11fbf5fd42845983ce0N.exe
- Size
  
  225KB
- MD5
  
  35bb48e85b36f11fbf5fd42845983ce0
- SHA1
  
  7ce9b5e1bdd166dcf0cc4545854f47ab5e2cb976
- SHA256
  
  3e5bfe0ca8f353e91e3f84bff969a9490e5edc381a96213a83d717f3dcfb9591
- SHA512
  
  40bd015aac479d902e9fc86acc38006b8cbacbf7c9dcd4a57643ce3d9bdb0102aef129fd89828f3666d79290322951239c3b5c8967bbf242424ef6b9471d08ef
- SSDEEP
  
  6144:AA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:AATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2