tinba | 0cbd571f2cbb15bcc922a2fef69b5de0fcce818df2835deeebffcd0481ce4832 | Triage

Sharing

General

Target

1edfcd0d4fc5c270ea507d2d28913ad0N.exe
Size

225KB
Sample

240820-zl1ztawfpl
MD5

1edfcd0d4fc5c270ea507d2d28913ad0
SHA1

d42fb7913e8aa52488fa1887f6695fe09b7a97eb
SHA256

0cbd571f2cbb15bcc922a2fef69b5de0fcce818df2835deeebffcd0481ce4832
SHA512

ca04804f6b908507490dbfad137b10b406da6ebb72b8b9f2b1cb02fe7b1565056db6e937735962877a24e98b715d98a8f81095713e14e1bfbd4c7bed19a21145
SSDEEP

6144:KA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:KATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  1edfcd0d4fc5c270ea507d2d28913ad0N.exe
- Size
  
  225KB
- MD5
  
  1edfcd0d4fc5c270ea507d2d28913ad0
- SHA1
  
  d42fb7913e8aa52488fa1887f6695fe09b7a97eb
- SHA256
  
  0cbd571f2cbb15bcc922a2fef69b5de0fcce818df2835deeebffcd0481ce4832
- SHA512
  
  ca04804f6b908507490dbfad137b10b406da6ebb72b8b9f2b1cb02fe7b1565056db6e937735962877a24e98b715d98a8f81095713e14e1bfbd4c7bed19a21145
- SSDEEP
  
  6144:KA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:KATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2