tinba | 24de2ecc32ea6b53430084771f000ff50fb1d53b3cee1a5c68d1ecaff0418bd2 | Triage

Sharing

General

Target

980836cd4ef2e452cdb1efc01bc92640N
Size

225KB
Sample

240907-z5zk4awanr
MD5

980836cd4ef2e452cdb1efc01bc92640
SHA1

0ccd5e8ba606c93cbbd40a664d40e87a78be365a
SHA256

24de2ecc32ea6b53430084771f000ff50fb1d53b3cee1a5c68d1ecaff0418bd2
SHA512

27f87aa77eaeb7c65ca1a0d6fc400697a462a0aded1b9d643d4fa37bd209b5c71e7fa2e48ac1b6d606723cac889d323da894794201933c3826dc2ce51ffb3d23
SSDEEP

6144:KA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:KATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  980836cd4ef2e452cdb1efc01bc92640N
- Size
  
  225KB
- MD5
  
  980836cd4ef2e452cdb1efc01bc92640
- SHA1
  
  0ccd5e8ba606c93cbbd40a664d40e87a78be365a
- SHA256
  
  24de2ecc32ea6b53430084771f000ff50fb1d53b3cee1a5c68d1ecaff0418bd2
- SHA512
  
  27f87aa77eaeb7c65ca1a0d6fc400697a462a0aded1b9d643d4fa37bd209b5c71e7fa2e48ac1b6d606723cac889d323da894794201933c3826dc2ce51ffb3d23
- SSDEEP
  
  6144:KA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:KATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2