tinba | 3cd83525ff191c0a4d73001cae2e8a39b21f9b8575c8688b706d44a94f9292a1 | Triage

Sharing

General

Target

97224a0cd63a70632a54befaff25fe50N
Size

237KB
Sample

240912-dmhzqsyblc
MD5

97224a0cd63a70632a54befaff25fe50
SHA1

7c48dccdf27a4a4a6129887f1312d6d2aa725935
SHA256

3cd83525ff191c0a4d73001cae2e8a39b21f9b8575c8688b706d44a94f9292a1
SHA512

67f0c89364356f1f326bf489684471d7afb7bc4cc8fa717782be71ad71c1bc0da3d4115beeec6bc478e47aa276bd3da27722353e216e526e1c8ad3cbb52037b7
SSDEEP

6144:rA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:rATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  97224a0cd63a70632a54befaff25fe50N
- Size
  
  237KB
- MD5
  
  97224a0cd63a70632a54befaff25fe50
- SHA1
  
  7c48dccdf27a4a4a6129887f1312d6d2aa725935
- SHA256
  
  3cd83525ff191c0a4d73001cae2e8a39b21f9b8575c8688b706d44a94f9292a1
- SHA512
  
  67f0c89364356f1f326bf489684471d7afb7bc4cc8fa717782be71ad71c1bc0da3d4115beeec6bc478e47aa276bd3da27722353e216e526e1c8ad3cbb52037b7
- SSDEEP
  
  6144:rA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:rATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2