tinba | 624aaa66bdb190720a3017a21b3ff9b21bd9849f1b1df5b2f1305cd24359c78a | Triage

Sharing

General

Target

b7620b6adf5f0bd58d84f7cde0e3dcfb.zip
Size

39KB
Sample

240831-nk52la1cml
MD5

f9d5cb506b65ccaea26ab1c18b0ebd4c
SHA1

dc6eb0db11558d0371d8fc85477a80299d697d5d
SHA256

624aaa66bdb190720a3017a21b3ff9b21bd9849f1b1df5b2f1305cd24359c78a
SHA512

54a0cf25084d2c1fe2c94507e83ec9bafda0a26bdd52e55713d18d054450bdd192ee48481272cb69f2f593aef6f6652d096985045fbf63b4f9c38457bb684b7a
SSDEEP

768:U5JaDU8m0sG8ShILQWC36Ya7LBdjYmoIOtqL4lxECOmIuryoLdjCROU:US48m0szSiLjxrjYbxtREFrX

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8a3c975f041bcec99b0495f9e67366b68baac6d0c5deb11dd11a77270892befe
- Size
  
  88KB
- MD5
  
  b7620b6adf5f0bd58d84f7cde0e3dcfb
- SHA1
  
  a20820d463caece8930917c193d2c344049740d3
- SHA256
  
  8a3c975f041bcec99b0495f9e67366b68baac6d0c5deb11dd11a77270892befe
- SHA512
  
  f40511b157528f234cea14bea4b9357ec913ebde8fe2245c6a6e646433d1cc5581d3f5178f3c3b2c569dcf38d0a1a415dbd7abfe3d60f033ea74ebba25dc12e9
- SSDEEP
  
  1536:v5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:v5fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan