tinba | d2176c99c562fb5e2b2c6cad1bd8b09a085b3d9d0836ea0044cd8a5b681f4941 | Triage

Sharing

General

Target

154c5af1e367afa1654e6ace851b15b1.zip
Size

29KB
Sample

240903-xrg3satgpm
MD5

d86face8362505631f95a89b9022065f
SHA1

f984cd1b277402eecb5ca129d2f74e39b1712071
SHA256

d2176c99c562fb5e2b2c6cad1bd8b09a085b3d9d0836ea0044cd8a5b681f4941
SHA512

c4a0db64771e1b5e85c3bec1b397e4896028e1981aac3495ecdf89e69489b96a459550f0da2dbe735e6d07c9e33842f7c6a63ab33570f2963d001ee97b206654
SSDEEP

768:Qnab2y80JCq1sB2+XN9Eb4rWZW95Kr4iZ2gYkHJgndg:+QDw2+XNSbU9zaEdg

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  68ef3fdecd9e3a995ee2a5cecc8742f35fb49c2a1dd3cc208322ecd70b7e77d8
- Size
  
  49KB
- MD5
  
  154c5af1e367afa1654e6ace851b15b1
- SHA1
  
  8d46d47c3f9db51f4efe563d9343ca80fd178cf8
- SHA256
  
  68ef3fdecd9e3a995ee2a5cecc8742f35fb49c2a1dd3cc208322ecd70b7e77d8
- SHA512
  
  00fe52f05b3f44758db0a725cba5176efac6655d459ec0411bf67bea1317d10203f3be4ec7f82af8ca5679c9d054130c53aeb6b4c2632927a123dfc985a6e189
- SSDEEP
  
  768:/CCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:bbw/6plBTFBYNNR9Jw
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan