tinba | b2bd468491080d763f46126db7b4be5307d6b09730de65cc1a08fe09f191fc42 | Triage

Sharing

General

Target

b2bd468491080d763f46126db7b4be5307d6b09730de65cc1a08fe09f191fc42
Size

89KB
Sample

240910-bqrd6s1hlb
MD5

48ea9300779f17c7b054a9ce7adc32f7
SHA1

29b93ae4437264a7f25db4ea1c1c921cc6e6bfa7
SHA256

b2bd468491080d763f46126db7b4be5307d6b09730de65cc1a08fe09f191fc42
SHA512

04578d59e9862787ae01aed4bae45d15607a6007366862e95bf5e9b4ff6e022917c36cb19c1ba444b71437082e74fcbb2fa75f3d05c7d57ab1b680df098eb8b4
SSDEEP

1536:m9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:m9o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  b2bd468491080d763f46126db7b4be5307d6b09730de65cc1a08fe09f191fc42
- Size
  
  89KB
- MD5
  
  48ea9300779f17c7b054a9ce7adc32f7
- SHA1
  
  29b93ae4437264a7f25db4ea1c1c921cc6e6bfa7
- SHA256
  
  b2bd468491080d763f46126db7b4be5307d6b09730de65cc1a08fe09f191fc42
- SHA512
  
  04578d59e9862787ae01aed4bae45d15607a6007366862e95bf5e9b4ff6e022917c36cb19c1ba444b71437082e74fcbb2fa75f3d05c7d57ab1b680df098eb8b4
- SSDEEP
  
  1536:m9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:m9o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2