tinba | 75a02f10024c9590966bac7b29558f12280d0d2a3fc38b8b1fd972f4c162fb0c | Triage

Sharing

General

Target

42ffa469f1e561ffe9f3692e7597ae01.zip
Size

39KB
Sample

240831-lpzz2axdpc
MD5

4e04bd9d159e843e712deed4f9149e25
SHA1

531087f8a5e6bc0ec70f4d560bb0171b3d9f5218
SHA256

75a02f10024c9590966bac7b29558f12280d0d2a3fc38b8b1fd972f4c162fb0c
SHA512

7a4941c246b9ca663c5870eec9d024d3bc1d7bf413a1a3b915e7a8c3713e12d067e04d16f556b753ff0a6dba5a089bbb7eeb02be49f349f7b6f0361b61267b18
SSDEEP

768:VdP54mBzVsyz8/6ra2yeuAv61IJKUgTNQnxL9PRiAJLfqxxMlX4+udKqepsc328k:14m52SvrTyeu+nKUgTNO9Pqx4X4+ieGB

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  483aea1a285779f49a95ae0504138fd55471a7513c7d839f3874997681cff0bd
- Size
  
  88KB
- MD5
  
  42ffa469f1e561ffe9f3692e7597ae01
- SHA1
  
  74914e574178df543f1bfe0abae25485d7279731
- SHA256
  
  483aea1a285779f49a95ae0504138fd55471a7513c7d839f3874997681cff0bd
- SHA512
  
  32482df140c96c37eec5d53028bbf216797afc6d408d91ec2bd2b2ba219377407cfc80cc928dc246314b1fad112b295d52b99c0ee3e9f31b4a821d8c3e9043d6
- SSDEEP
  
  1536:05nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:05fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan