tinba | f70a9256b11888a37401b3962ef20700121bd5a3bfc76d9cd8683bc9ce93fac3 | Triage

Sharing

General

Target

f70a9256b11888a37401b3962ef20700121bd5a3bfc76d9cd8683bc9ce93fac3
Size

39KB
Sample

240831-nllpca1cmb
MD5

19607b2e6a12165573848253cde05644
SHA1

1c44ac38157aa4fb786f65886a946b32e874119e
SHA256

f70a9256b11888a37401b3962ef20700121bd5a3bfc76d9cd8683bc9ce93fac3
SHA512

79ebe0bcf7e8351d7cf52ddf311b29bc3dde3c81121e09fafa2aea39b5ffa76c20e425ad50fc1ec3c6f9ea461d679ef92a9dd37e8078de22c1b7aff341467d45
SSDEEP

768:7EzHFjATszpP65EkgbI6HoZOgkFLz/AtTuwdz1jOstMr3BaYbgGCjjdnmSB7pIFR:4zHFjATmtbI6MJkBzUTPdJRMr8hdnzBI

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  1ad7262bfeb74b635d9b56330a257940fa12124f4935efd21f5f0308c261ca1f
- Size
  
  88KB
- MD5
  
  40f8d5b0ef42b3f1dc9af41c77f537c4
- SHA1
  
  4bd45492ec4173509dbfd68468ac19031a96240a
- SHA256
  
  1ad7262bfeb74b635d9b56330a257940fa12124f4935efd21f5f0308c261ca1f
- SHA512
  
  db5b9b5a9942824441cf5675202eb3a8b2049a8ae6058fa27a7cdb3ad9c0482fb1c77382285bd6e73801014c7b560ade8a17065ebf68e1faef00b3bf2c35052d
- SSDEEP
  
  1536:E5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:E5fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan