tinba | 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07 | Triage

Sharing

General

Target

19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07
Size

225KB
Sample

240818-xp69wsyfqg
MD5

72c5ac4edb065d813e9e3fa19dd9469c
SHA1

dcfb6dfbb2e93f2be8bd1c5f8edf83b210468e43
SHA256

19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07
SHA512

7600e762703d7e917c38d622a34bbd77e814466636ecb4935ab024ea3ac56f4a8b733a17c97eedc49a2a8f495a5661fd25448208bc9bc39726d90f654d8dddd4
SSDEEP

6144:pA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:pATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07
- Size
  
  225KB
- MD5
  
  72c5ac4edb065d813e9e3fa19dd9469c
- SHA1
  
  dcfb6dfbb2e93f2be8bd1c5f8edf83b210468e43
- SHA256
  
  19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07
- SHA512
  
  7600e762703d7e917c38d622a34bbd77e814466636ecb4935ab024ea3ac56f4a8b733a17c97eedc49a2a8f495a5661fd25448208bc9bc39726d90f654d8dddd4
- SSDEEP
  
  6144:pA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:pATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2