tinba | 446156cab04d4f29ecee92429d9cba29e4403be17b677e74cde58e39e6487f20 | Triage

Sharing

General

Target

446156cab04d4f29ecee92429d9cba29e4403be17b677e74cde58e39e6487f20.exe
Size

68KB
Sample

240830-bqqsmszglc
MD5

50c7ce412d99eb4769411d6b60a34ac6
SHA1

551d077916a61780fb055f6e3b27c0f2ba4d3378
SHA256

446156cab04d4f29ecee92429d9cba29e4403be17b677e74cde58e39e6487f20
SHA512

e763c3d8ea8bf58f466ff8ead43234b5d6bfacb5753437e34fe19ee1f808c7c454211866f4a676900330b0020feb08187f87e82edf804271fe5f4cf9abf8d5b0
SSDEEP

768:1waGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:147urp3v23HSa0AMNyfQ1d2y4Z4P

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  446156cab04d4f29ecee92429d9cba29e4403be17b677e74cde58e39e6487f20.exe
- Size
  
  68KB
- MD5
  
  50c7ce412d99eb4769411d6b60a34ac6
- SHA1
  
  551d077916a61780fb055f6e3b27c0f2ba4d3378
- SHA256
  
  446156cab04d4f29ecee92429d9cba29e4403be17b677e74cde58e39e6487f20
- SHA512
  
  e763c3d8ea8bf58f466ff8ead43234b5d6bfacb5753437e34fe19ee1f808c7c454211866f4a676900330b0020feb08187f87e82edf804271fe5f4cf9abf8d5b0
- SSDEEP
  
  768:1waGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:147urp3v23HSa0AMNyfQ1d2y4Z4P
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2