tinba | aec1b9d9a1d0dfb23ce82acd363f6f2652f7bd5d0a5fd31445b550436aacc5c3 | Triage

Sharing

General

Target

9a46ea5727981c972b3b6c7ef8f5ed80N
Size

237KB
Sample

240910-wj6whawhqk
MD5

9a46ea5727981c972b3b6c7ef8f5ed80
SHA1

5f7c7e1ba85b84a1f213f031b54778c39a122841
SHA256

aec1b9d9a1d0dfb23ce82acd363f6f2652f7bd5d0a5fd31445b550436aacc5c3
SHA512

0f980e93ce404557681f26093c345cd7a0768592a405ce276fd73c9b4d658e32f3200265a01bfdd6be26ccdf87ad11cd0ead074dc224c7de17be0f9bdbf59fab
SSDEEP

6144:MA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:MATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  9a46ea5727981c972b3b6c7ef8f5ed80N
- Size
  
  237KB
- MD5
  
  9a46ea5727981c972b3b6c7ef8f5ed80
- SHA1
  
  5f7c7e1ba85b84a1f213f031b54778c39a122841
- SHA256
  
  aec1b9d9a1d0dfb23ce82acd363f6f2652f7bd5d0a5fd31445b550436aacc5c3
- SHA512
  
  0f980e93ce404557681f26093c345cd7a0768592a405ce276fd73c9b4d658e32f3200265a01bfdd6be26ccdf87ad11cd0ead074dc224c7de17be0f9bdbf59fab
- SSDEEP
  
  6144:MA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:MATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2