tinba | 2ed26169d9b06429da53ec5ae24ce3f6318c532a015b5c20fd957e63cd2ef47f | Triage

Sharing

General

Target

2ed26169d9b06429da53ec5ae24ce3f6318c532a015b5c20fd957e63cd2ef47f
Size

237KB
Sample

240903-yv8kkswhqb
MD5

3f60db6af7aed908d5de03828ca55adf
SHA1

42089d39840809a7f172c2beaa76b1229940a3b5
SHA256

2ed26169d9b06429da53ec5ae24ce3f6318c532a015b5c20fd957e63cd2ef47f
SHA512

155b2c65a2d267881f2a5e3b21fec79c357fb26bdf35995036625b6a3973d29ca34c46ebf583ce8a0c2a3bae60b326468216180e0b6858b662b9cef7595c2867
SSDEEP

6144:oA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:oATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  2ed26169d9b06429da53ec5ae24ce3f6318c532a015b5c20fd957e63cd2ef47f
- Size
  
  237KB
- MD5
  
  3f60db6af7aed908d5de03828ca55adf
- SHA1
  
  42089d39840809a7f172c2beaa76b1229940a3b5
- SHA256
  
  2ed26169d9b06429da53ec5ae24ce3f6318c532a015b5c20fd957e63cd2ef47f
- SHA512
  
  155b2c65a2d267881f2a5e3b21fec79c357fb26bdf35995036625b6a3973d29ca34c46ebf583ce8a0c2a3bae60b326468216180e0b6858b662b9cef7595c2867
- SSDEEP
  
  6144:oA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:oATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2