tinba | b8c116f89581004ecdda608bbb57a34cd02f287224367aaa03be858b2473bf17 | Triage

Sharing

General

Target

9e68dac9ec41fbe3eb9b47b03ae65ff0N.exe
Size

225KB
Sample

240821-ysyycsxgma
MD5

9e68dac9ec41fbe3eb9b47b03ae65ff0
SHA1

8b1746b38330bbefbd08751357fa21418e56b3be
SHA256

b8c116f89581004ecdda608bbb57a34cd02f287224367aaa03be858b2473bf17
SHA512

e6f7d4dfd8b8cde5ac1f42ca73e68cd6513b74e998e90733e26beb70a4d2c2ba5e2ba8afc54e9e4d409c2cc600743f7d35fd62e76e1cde14bc17b482615c8369
SSDEEP

6144:SNA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:gATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  9e68dac9ec41fbe3eb9b47b03ae65ff0N.exe
- Size
  
  225KB
- MD5
  
  9e68dac9ec41fbe3eb9b47b03ae65ff0
- SHA1
  
  8b1746b38330bbefbd08751357fa21418e56b3be
- SHA256
  
  b8c116f89581004ecdda608bbb57a34cd02f287224367aaa03be858b2473bf17
- SHA512
  
  e6f7d4dfd8b8cde5ac1f42ca73e68cd6513b74e998e90733e26beb70a4d2c2ba5e2ba8afc54e9e4d409c2cc600743f7d35fd62e76e1cde14bc17b482615c8369
- SSDEEP
  
  6144:SNA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:gATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2