tinba | 9a202ba95c20cb17823b16cfc1c95b6d334023b1c67317334f20962cc28e3013 | Triage

Sharing

General

Target

9a202ba95c20cb17823b16cfc1c95b6d334023b1c67317334f20962cc28e3013
Size

225KB
Sample

240912-adm1js1arl
MD5

9bdb0626f6c5923879be1363fda6b9a2
SHA1

0eee76ab62eb975fdebb89b4e8998c31bd80482c
SHA256

9a202ba95c20cb17823b16cfc1c95b6d334023b1c67317334f20962cc28e3013
SHA512

99eb7b4224563e1797137bb05aff5a18e750951692f4af44adaffab76598e3c680282b61d9572e47a25906326be0d61795118727e36888380c44b9ca8379373e
SSDEEP

6144:dA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:dATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  9a202ba95c20cb17823b16cfc1c95b6d334023b1c67317334f20962cc28e3013
- Size
  
  225KB
- MD5
  
  9bdb0626f6c5923879be1363fda6b9a2
- SHA1
  
  0eee76ab62eb975fdebb89b4e8998c31bd80482c
- SHA256
  
  9a202ba95c20cb17823b16cfc1c95b6d334023b1c67317334f20962cc28e3013
- SHA512
  
  99eb7b4224563e1797137bb05aff5a18e750951692f4af44adaffab76598e3c680282b61d9572e47a25906326be0d61795118727e36888380c44b9ca8379373e
- SSDEEP
  
  6144:dA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:dATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2