tinba | 8b5f226be0e7ee9765bedc69f9c0c0d1dd26dbee6b06305b287cb37fa173424f | Triage

Sharing

General

Target

12ca6cc4a8f8125e6a7e42e9c37e6d50N
Size

225KB
Sample

240826-j2e5aavglq
MD5

12ca6cc4a8f8125e6a7e42e9c37e6d50
SHA1

e6491439714b26dc1be9d3bcabc06df6fc21efac
SHA256

8b5f226be0e7ee9765bedc69f9c0c0d1dd26dbee6b06305b287cb37fa173424f
SHA512

fae45cb5d9709b8d2484bb80da42563f963bb0f276afc6277ad62ae9bcb071862fd43b779bb02080d6dfaa11ee0741899ae72368433f4556f4215d8d62369f67
SSDEEP

6144:rA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:rATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  12ca6cc4a8f8125e6a7e42e9c37e6d50N
- Size
  
  225KB
- MD5
  
  12ca6cc4a8f8125e6a7e42e9c37e6d50
- SHA1
  
  e6491439714b26dc1be9d3bcabc06df6fc21efac
- SHA256
  
  8b5f226be0e7ee9765bedc69f9c0c0d1dd26dbee6b06305b287cb37fa173424f
- SHA512
  
  fae45cb5d9709b8d2484bb80da42563f963bb0f276afc6277ad62ae9bcb071862fd43b779bb02080d6dfaa11ee0741899ae72368433f4556f4215d8d62369f67
- SSDEEP
  
  6144:rA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:rATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2