tinba | 906bc5b15406e775db54d5ee37fce00b71c1059b9588121c68026e3ff0b4f369 | Triage

Sharing

General

Target

8f8ad3d2f22955dfdca6dd49a82c29e0N.exe
Size

225KB
Sample

240905-bttzga1frb
MD5

8f8ad3d2f22955dfdca6dd49a82c29e0
SHA1

7bc1a2315eadc93e8c6bf63326ab80e3158eb90a
SHA256

906bc5b15406e775db54d5ee37fce00b71c1059b9588121c68026e3ff0b4f369
SHA512

86079a3b7ef683e9c547855c0ee045c49c61a1e0ed41ab40d56e582adb18e2445b28c2216c9d6a078b916cb8e736568a3cd1ae4e376ed344c9293f7b0af8f0fd
SSDEEP

6144:DA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:DATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8f8ad3d2f22955dfdca6dd49a82c29e0N.exe
- Size
  
  225KB
- MD5
  
  8f8ad3d2f22955dfdca6dd49a82c29e0
- SHA1
  
  7bc1a2315eadc93e8c6bf63326ab80e3158eb90a
- SHA256
  
  906bc5b15406e775db54d5ee37fce00b71c1059b9588121c68026e3ff0b4f369
- SHA512
  
  86079a3b7ef683e9c547855c0ee045c49c61a1e0ed41ab40d56e582adb18e2445b28c2216c9d6a078b916cb8e736568a3cd1ae4e376ed344c9293f7b0af8f0fd
- SSDEEP
  
  6144:DA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:DATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2