tinba | 697d37ba4461728e282f2a826de1d8195bd6b94abb4abd4c0dd209fe4d61d5f2 | Triage

Sharing

General

Target

7d7bbc012a46508b6e8bf063bc60b5f0N.exe
Size

225KB
Sample

240827-ee8e4a1fna
MD5

7d7bbc012a46508b6e8bf063bc60b5f0
SHA1

4581c3108512a6b6631bbb2956d84416c69e1ae9
SHA256

697d37ba4461728e282f2a826de1d8195bd6b94abb4abd4c0dd209fe4d61d5f2
SHA512

60e502796d06729b848d7947e25895b705d2d334ee72b3d5324c465a118889eac39860b0fcae81e9db5fd4280a690d3c9dde8d1d4424bf592a3486ea26aede37
SSDEEP

6144:SA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:SATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  7d7bbc012a46508b6e8bf063bc60b5f0N.exe
- Size
  
  225KB
- MD5
  
  7d7bbc012a46508b6e8bf063bc60b5f0
- SHA1
  
  4581c3108512a6b6631bbb2956d84416c69e1ae9
- SHA256
  
  697d37ba4461728e282f2a826de1d8195bd6b94abb4abd4c0dd209fe4d61d5f2
- SHA512
  
  60e502796d06729b848d7947e25895b705d2d334ee72b3d5324c465a118889eac39860b0fcae81e9db5fd4280a690d3c9dde8d1d4424bf592a3486ea26aede37
- SSDEEP
  
  6144:SA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:SATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2