tinba | 5158633cdcd58e7df4c5c33b714dcb4b6de86821f1d3af88e4006d3758cee633 | Triage

Sharing

General

Target

5158633cdcd58e7df4c5c33b714dcb4b6de86821f1d3af88e4006d3758cee633
Size

29KB
Sample

240902-jnprkawgne
MD5

9ff6ea1fbab50181b80bffb98bd33109
SHA1

10db2370b47d545dfb29839ac2d0edd5d168f95a
SHA256

5158633cdcd58e7df4c5c33b714dcb4b6de86821f1d3af88e4006d3758cee633
SHA512

a08d01702d60c3ddac8c4fadcc5cd86032ac39e325b45b8fd925fa0154f98c158729d6de5bfe8055ce6865ee693d5555d91728cfbc9a25574f898f67e5e28d41
SSDEEP

384:sxMPFR48nxC4vA3ZccmolW2s38KU9NvjuHHNptkihHTGmvw6Klkviz7/5CvYJnC7:z/4EPywkNvSHHNkh96CZV9ZsAoPsKX5

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  640db2b24b1ff39f4c6c8eb1d177c7d9882d55839744901e55891a496bab7304
- Size
  
  49KB
- MD5
  
  95ba507c62f9bfbe0bc258702450e634
- SHA1
  
  1a3af882c7600a021a7a01e5739e630ad45dc3b8
- SHA256
  
  640db2b24b1ff39f4c6c8eb1d177c7d9882d55839744901e55891a496bab7304
- SHA512
  
  f2d33ced2ca42e7d0d7922f6778b3ad8aa362418d86e6f45285d2069fce6ca8f0b52b3155f4165ebdb84d4b74764a768acd497eeb1a70dd1fa47ef5044d6c565
- SSDEEP
  
  768:LCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:vbw/6plBTFBYNNR9Jw
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan