tinba | 10be9849a7161155d7bad50dbdb3f2b07541463c6c0ba1da65d656ac5217f40e | Triage

Sharing

General

Target

9abe1bd91835dd1f68db89eef185d130N
Size

96KB
Sample

240911-fthcwsvekc
MD5

9abe1bd91835dd1f68db89eef185d130
SHA1

d673b75f47394e9c258bfc58b1d04c86fb16de7b
SHA256

10be9849a7161155d7bad50dbdb3f2b07541463c6c0ba1da65d656ac5217f40e
SHA512

87002f4a0a4bba65b5c0d5fdd7fc813b649191b0b24d132010aa100a78d06a85626decdbcc883cb4d074a5a32a7fbfa06ccd2aa0d93df991a9ef5f4f4e88b324
SSDEEP

1536:+iLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:+iyvRmQKTLs/ZrwWJjAqGct

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  9abe1bd91835dd1f68db89eef185d130N
- Size
  
  96KB
- MD5
  
  9abe1bd91835dd1f68db89eef185d130
- SHA1
  
  d673b75f47394e9c258bfc58b1d04c86fb16de7b
- SHA256
  
  10be9849a7161155d7bad50dbdb3f2b07541463c6c0ba1da65d656ac5217f40e
- SHA512
  
  87002f4a0a4bba65b5c0d5fdd7fc813b649191b0b24d132010aa100a78d06a85626decdbcc883cb4d074a5a32a7fbfa06ccd2aa0d93df991a9ef5f4f4e88b324
- SSDEEP
  
  1536:+iLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:+iyvRmQKTLs/ZrwWJjAqGct
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan