tinba | 50a8ad36885635ecaefada8b688e4a6a5489f2470d158e8544b607e2977b4568 | Triage

Sharing

General

Target

50a8ad36885635ecaefada8b688e4a6a5489f2470d158e8544b607e2977b4568
Size

225KB
Sample

240825-1nd4hawhnd
MD5

3edc4dbfae519cade6fbf8330933c77a
SHA1

df9890705cd404eb24560cc237b860294accb1b2
SHA256

50a8ad36885635ecaefada8b688e4a6a5489f2470d158e8544b607e2977b4568
SHA512

80280a337d9e1b2d85eef5e16c51f15040d647e74eee7c0836fc04f2df8fa9365c5f9ebfdf6c84b4ce4b8cc46259946c433aa1f79bb9a94a1032d8ce18569a73
SSDEEP

6144:MA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:MATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  50a8ad36885635ecaefada8b688e4a6a5489f2470d158e8544b607e2977b4568
- Size
  
  225KB
- MD5
  
  3edc4dbfae519cade6fbf8330933c77a
- SHA1
  
  df9890705cd404eb24560cc237b860294accb1b2
- SHA256
  
  50a8ad36885635ecaefada8b688e4a6a5489f2470d158e8544b607e2977b4568
- SHA512
  
  80280a337d9e1b2d85eef5e16c51f15040d647e74eee7c0836fc04f2df8fa9365c5f9ebfdf6c84b4ce4b8cc46259946c433aa1f79bb9a94a1032d8ce18569a73
- SSDEEP
  
  6144:MA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:MATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2