tinba | 18b3661ebdd34d7a89b788e79d87d62467fa26187874cc71fa3176a6d01752a7 | Triage

Sharing

General

Target

242a2c3c37188e2ecf3e79798149a3df.zip
Size

141KB
Sample

240831-ajl1fathre
MD5

42aca95e45f8a4dd23d03e5769f56187
SHA1

ef229ac7a566c098c3477233ce7d6dc67163319c
SHA256

18b3661ebdd34d7a89b788e79d87d62467fa26187874cc71fa3176a6d01752a7
SHA512

4ff59c3af2824a5498fa19cf59707be78722fbc2cf170b546bcc63385134ce38edfde4f8887718c4dd2d993d852d2f03b3665f5c7e3a24c6352afdfae95bafbb
SSDEEP

3072:Q3kUM5oDhRaVvL4tc/vmDw019xDEUypsQPqkEcAiA:yioDhRiLUHVxDEtsQyh1f

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4690ef9e8a7a77ea30029eeb1b913bceeab75a71bf18dce34c26467fa9d4cdda
- Size
  
  372KB
- MD5
  
  242a2c3c37188e2ecf3e79798149a3df
- SHA1
  
  0b3d5ed0fd1aca72ef55e6e664f6ffdc84e6a637
- SHA256
  
  4690ef9e8a7a77ea30029eeb1b913bceeab75a71bf18dce34c26467fa9d4cdda
- SHA512
  
  2c8dde71609b8499fbb179adce659fc008dc8948fe79cf8ef3cc2669274d5b3070a2ef8605a9018a58b67ad0976d3b8f6b4b4ed4c09891b296f4587fbdcd54c2
- SSDEEP
  
  6144:8CE6/mUXJ531nIUliViSZbLhaZfvMlLXICg:86TOUMBQf0ljW
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2