tinba | b8fc55e5a5df539b19ebc778c55d2a16cc4115d7da7b8f0c0ff985aca64d902b | Triage

Sharing

General

Target

b8fc55e5a5df539b19ebc778c55d2a16cc4115d7da7b8f0c0ff985aca64d902b
Size

29KB
Sample

240831-bvq9zaxgjd
MD5

66166c44842cc2009634027d2f329b5c
SHA1

a36470dec161f45f6fb2e6e5e0961b0f3a525fd1
SHA256

b8fc55e5a5df539b19ebc778c55d2a16cc4115d7da7b8f0c0ff985aca64d902b
SHA512

9ae393b5f1067a0aace85dd3d89428673d6cca0eb11cba5fcb409a2d5e7728f297d004d14caa352d47b3f410808905c65915134c554c9f78a63d7008d7a14374
SSDEEP

384:NXhjsmUAy8rzP4raMy0t9yHiQF6BZr++4C2p1dfqigV0ZWifA3NiR2/YGcqFi2ci:NXhoqP4raMAiraz1JMfifoi+i2c3eF/

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d
- Size
  
  52KB
- MD5
  
  5677387e86650ea25137cb5bce341349
- SHA1
  
  bf3e5583fb2b052a3ca9d9fd53e75c6bab6942d2
- SHA256
  
  ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d
- SHA512
  
  d0e079e0eef54a32a408e47131633f3b82a3d119fe261c71749f38b1f39188e3d0965da37caa5e9850a0791a8bafdefed566a2c3cbd17c26eeb8f92cdbd9de86
- SSDEEP
  
  768:yCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9J:6bw/6plBTFBYNNR9J
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan