tinba | 0748cd374d64156fc533b0f10d437fdbb7ccad4e8b697b3cd2eeea252c466149 | Triage

Sharing

General

Target

PrintWiz.exe
Size

225KB
Sample

240902-23dxqa1cqa
MD5

d87895c34f37cf8d3450cc47541fcc4c
SHA1

f2a854989634cc54de97895af07f7ad0e72c47d8
SHA256

0748cd374d64156fc533b0f10d437fdbb7ccad4e8b697b3cd2eeea252c466149
SHA512

9c038353ebcbc703aecca14777ae7a39b26c61413987474cb7433f68072b5ee73dc59eaaf8a17358c5e281ed9310369b6b71a60c886046a809682f4e639572e4
SSDEEP

6144:QA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:QATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  PrintWiz.exe
- Size
  
  225KB
- MD5
  
  d87895c34f37cf8d3450cc47541fcc4c
- SHA1
  
  f2a854989634cc54de97895af07f7ad0e72c47d8
- SHA256
  
  0748cd374d64156fc533b0f10d437fdbb7ccad4e8b697b3cd2eeea252c466149
- SHA512
  
  9c038353ebcbc703aecca14777ae7a39b26c61413987474cb7433f68072b5ee73dc59eaaf8a17358c5e281ed9310369b6b71a60c886046a809682f4e639572e4
- SSDEEP
  
  6144:QA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:QATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2