tinba | e9041236f2a1df33961c80942252bb0a1cb1e4bb668eed078ae7c05b4d30c528 | Triage

Sharing

General

Target

d83a209e3025196f0172a8273e13d590N
Size

225KB
Sample

240826-t6c6latgka
MD5

d83a209e3025196f0172a8273e13d590
SHA1

3297383293035a72bedb627466131630f7a06f5f
SHA256

e9041236f2a1df33961c80942252bb0a1cb1e4bb668eed078ae7c05b4d30c528
SHA512

3218a26a21adc120fe336a6e61dc7d7d2e7f223552b762b585c31333454117fc061e601acee520b1ae68f875b72358d4d364bb6c6174bc1f6ace1757f145fab9
SSDEEP

6144:BA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:BATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  d83a209e3025196f0172a8273e13d590N
- Size
  
  225KB
- MD5
  
  d83a209e3025196f0172a8273e13d590
- SHA1
  
  3297383293035a72bedb627466131630f7a06f5f
- SHA256
  
  e9041236f2a1df33961c80942252bb0a1cb1e4bb668eed078ae7c05b4d30c528
- SHA512
  
  3218a26a21adc120fe336a6e61dc7d7d2e7f223552b762b585c31333454117fc061e601acee520b1ae68f875b72358d4d364bb6c6174bc1f6ace1757f145fab9
- SSDEEP
  
  6144:BA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:BATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2