tinba | 184a249bfbe3ff35c6031b3b3105776f7c55e33add59082ac70f6ce5fb0711a4 | Triage

Sharing

General

Target

50c7ce412d99eb4769411d6b60a34ac6.bin
Size

32KB
Sample

240831-bqgvqsxgkl
MD5

37443d02ba9ce2d921e40c7f24ab01e9
SHA1

8db8b06dd75205c740d56fe1cc96a5af1381363c
SHA256

184a249bfbe3ff35c6031b3b3105776f7c55e33add59082ac70f6ce5fb0711a4
SHA512

f53112aaf411934b44bce789ec19efce1b7c4e8bea9ed2ce584b56e514b04651f2672059401655116c67341761ea15f612238ce55e8fb2f880b15a8ced6bfca2
SSDEEP

768:+FHeSyQEJ4DbrhqAUU9/DCMsIo8Jw+3WgDO4:+qqDbrhxUUEMsI/H3WsO4

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  446156cab04d4f29ecee92429d9cba29e4403be17b677e74cde58e39e6487f20.exe
- Size
  
  68KB
- MD5
  
  50c7ce412d99eb4769411d6b60a34ac6
- SHA1
  
  551d077916a61780fb055f6e3b27c0f2ba4d3378
- SHA256
  
  446156cab04d4f29ecee92429d9cba29e4403be17b677e74cde58e39e6487f20
- SHA512
  
  e763c3d8ea8bf58f466ff8ead43234b5d6bfacb5753437e34fe19ee1f808c7c454211866f4a676900330b0020feb08187f87e82edf804271fe5f4cf9abf8d5b0
- SSDEEP
  
  768:1waGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:147urp3v23HSa0AMNyfQ1d2y4Z4P
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2