tinba | b29dd1f2edab8ee4951c4316bc1f65f63bd903c7ab4b58d5be1e4b63ce376447 | Triage

Sharing

General

Target

18b5fbe1d93d00244293b438b279eb80N.exe
Size

225KB
Sample

240827-xsjyrswgle
MD5

18b5fbe1d93d00244293b438b279eb80
SHA1

87fbfd26bc799a314c26e550ce43281bccb37c00
SHA256

b29dd1f2edab8ee4951c4316bc1f65f63bd903c7ab4b58d5be1e4b63ce376447
SHA512

245c7fe80fac3412d92f1a32d7804ef91874e9316cea6851a54133fe71fb0907a90d02d8405c7cdf1b3cbe3bc121d0271e8047a7aa0d181a60ec5b7360555454
SSDEEP

6144:VA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:VATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  18b5fbe1d93d00244293b438b279eb80N.exe
- Size
  
  225KB
- MD5
  
  18b5fbe1d93d00244293b438b279eb80
- SHA1
  
  87fbfd26bc799a314c26e550ce43281bccb37c00
- SHA256
  
  b29dd1f2edab8ee4951c4316bc1f65f63bd903c7ab4b58d5be1e4b63ce376447
- SHA512
  
  245c7fe80fac3412d92f1a32d7804ef91874e9316cea6851a54133fe71fb0907a90d02d8405c7cdf1b3cbe3bc121d0271e8047a7aa0d181a60ec5b7360555454
- SSDEEP
  
  6144:VA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:VATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2