tinba | 7f30e3c954a307a43b1e7dae7d6769e7d83c76e74f54e1cd20daf7849d6b4e84 | Triage

Sharing

General

Target

7f30e3c954a307a43b1e7dae7d6769e7d83c76e74f54e1cd20daf7849d6b4e84
Size

40KB
Sample

240901-1h4f7ssdmm
MD5

712ef51c65df249656333213ef6cb0ab
SHA1

c80daef99b4225981f031574aea2e8688e2a0052
SHA256

7f30e3c954a307a43b1e7dae7d6769e7d83c76e74f54e1cd20daf7849d6b4e84
SHA512

7777382610a4f8568d7ecd6ab00660e6c7f861b1bbe9f7c9e09e7c853fae0f89a98bcb9bb9cd595f956d02020c923441b2d012b2f266146844a23e50c8274133
SSDEEP

768:TNEmUusXFKXYPLFJDpBUrEF1VsCi0LQ7oYm2TXrckPessR9OHHyvwo:53UdXFKXSLFJDvUEFrsNbTXrRP3sRMHe

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  6b3045381513d819c92c265c847fc05d9fe591b3f0bef449a368ae17fd23f4f7
- Size
  
  96KB
- MD5
  
  42d6043b2470828883f624b8c22e56f2
- SHA1
  
  26e533b7bf95c6f8a3694a1887f29a0a76754ded
- SHA256
  
  6b3045381513d819c92c265c847fc05d9fe591b3f0bef449a368ae17fd23f4f7
- SHA512
  
  d64372a92ae9f0f2e5e03ba567b52ccc61ac550d8e614c25d29893dc5797ed17cefa6ad7faefb2ccbce193562156342324c48dedaf0be836cc2936c1acaef373
- SSDEEP
  
  1536:eiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:eiyvRmQKTLs/ZrwWJjAqGct
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan