tinba | 7254be7bf93513e12ee58e20f5c8f08665921437e37d85068d0caf609c0bbb89 | Triage

Sharing

General

Target

Trojan.Win32.Tinba.GZN.MTB-7254be7bf93513e12ee58e20f5c8f08665921437e37d85068d0caf609c0bbb89N
Size

237KB
Sample

240915-2ncfcawhnl
MD5

9c06d991e40abc0169ab676ff6fb35f0
SHA1

7aec5b3db994736c0a7b670239b4a00cb3b47848
SHA256

7254be7bf93513e12ee58e20f5c8f08665921437e37d85068d0caf609c0bbb89
SHA512

4c3956a801bfba72d7127dd2cda0f64c5190a376227c21a074b36a7039935c57aac78837104777124b47b25933c8982a05581f4c01fad62f68804a30f864e24b
SSDEEP

6144:KA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:KATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  Trojan.Win32.Tinba.GZN.MTB-7254be7bf93513e12ee58e20f5c8f08665921437e37d85068d0caf609c0bbb89N
- Size
  
  237KB
- MD5
  
  9c06d991e40abc0169ab676ff6fb35f0
- SHA1
  
  7aec5b3db994736c0a7b670239b4a00cb3b47848
- SHA256
  
  7254be7bf93513e12ee58e20f5c8f08665921437e37d85068d0caf609c0bbb89
- SHA512
  
  4c3956a801bfba72d7127dd2cda0f64c5190a376227c21a074b36a7039935c57aac78837104777124b47b25933c8982a05581f4c01fad62f68804a30f864e24b
- SSDEEP
  
  6144:KA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:KATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2