tinba | ae1e5626946df6d6d8bdefc6a6d224cc66c66d6d0af0668ade79366834eaea6b | Triage

Sharing

General

Target

ae1e5626946df6d6d8bdefc6a6d224cc66c66d6d0af0668ade79366834eaea6b
Size

68KB
Sample

240828-c16saatbpp
MD5

445317e05ccce0e5a0cacc7754112722
SHA1

900540543f4c9a50b11d737cf1e30e5f19203f56
SHA256

ae1e5626946df6d6d8bdefc6a6d224cc66c66d6d0af0668ade79366834eaea6b
SHA512

814ca58cb7c03371e8806f51eac9129db040e92f92de367e654110b2a001688e3439dc83da1832016b48cafb894dbcff999711fa729f09f338d333fba51d7d6d
SSDEEP

768:/waGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:/47urp3v23HSa0AMNyfQ1d2y4Z4P

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  ae1e5626946df6d6d8bdefc6a6d224cc66c66d6d0af0668ade79366834eaea6b
- Size
  
  68KB
- MD5
  
  445317e05ccce0e5a0cacc7754112722
- SHA1
  
  900540543f4c9a50b11d737cf1e30e5f19203f56
- SHA256
  
  ae1e5626946df6d6d8bdefc6a6d224cc66c66d6d0af0668ade79366834eaea6b
- SHA512
  
  814ca58cb7c03371e8806f51eac9129db040e92f92de367e654110b2a001688e3439dc83da1832016b48cafb894dbcff999711fa729f09f338d333fba51d7d6d
- SSDEEP
  
  768:/waGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:/47urp3v23HSa0AMNyfQ1d2y4Z4P
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2