tinba | ae3442533a3b68912db55a5a24f43795ea2e3ef92aed3a2995d25dc164f78027 | Triage

Sharing

General

Target

25bb4f38dbbc7272be4d9a550ce00e60N.exe
Size

237KB
Sample

240818-3v7eqsvfrl
MD5

25bb4f38dbbc7272be4d9a550ce00e60
SHA1

34bde51324fb065ebbd834b80cc520a6fa6f6c66
SHA256

ae3442533a3b68912db55a5a24f43795ea2e3ef92aed3a2995d25dc164f78027
SHA512

127e3f4f8c8ccc1ba2d82ab2366e12bbae24a7e8f634b7e691da29eb393e875be2588a3185b5fa06568373b6a0d65216dfd0fe93a969a79ae02687ca1275f82c
SSDEEP

6144:yA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:yATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  25bb4f38dbbc7272be4d9a550ce00e60N.exe
- Size
  
  237KB
- MD5
  
  25bb4f38dbbc7272be4d9a550ce00e60
- SHA1
  
  34bde51324fb065ebbd834b80cc520a6fa6f6c66
- SHA256
  
  ae3442533a3b68912db55a5a24f43795ea2e3ef92aed3a2995d25dc164f78027
- SHA512
  
  127e3f4f8c8ccc1ba2d82ab2366e12bbae24a7e8f634b7e691da29eb393e875be2588a3185b5fa06568373b6a0d65216dfd0fe93a969a79ae02687ca1275f82c
- SSDEEP
  
  6144:yA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:yATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2