tinba | bdbd54420937f334b6ff7523f2c8e0a51ece7b7aba56cce7f013b08c56a9f0e4 | Triage

Sharing

General

Target

bdbd54420937f334b6ff7523f2c8e0a51ece7b7aba56cce7f013b08c56a9f0e4N
Size

88KB
Sample

240917-v2lgvavglj
MD5

25a3504b6a4718635adc07a854746400
SHA1

bc8cc951fb4a2c9877436d6db01659e87f8645ca
SHA256

bdbd54420937f334b6ff7523f2c8e0a51ece7b7aba56cce7f013b08c56a9f0e4
SHA512

43e2c1b13e4fe95e946b1c5848361ec7795838849fafcb976c2b95f145bf2f33d63ba779afe782bc79f4b99d4656b5a37bc9628fb3dbb474e5f69fdc5a26d32f
SSDEEP

1536:4z44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:4zvokZR/KM/ysjwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  bdbd54420937f334b6ff7523f2c8e0a51ece7b7aba56cce7f013b08c56a9f0e4N
- Size
  
  88KB
- MD5
  
  25a3504b6a4718635adc07a854746400
- SHA1
  
  bc8cc951fb4a2c9877436d6db01659e87f8645ca
- SHA256
  
  bdbd54420937f334b6ff7523f2c8e0a51ece7b7aba56cce7f013b08c56a9f0e4
- SHA512
  
  43e2c1b13e4fe95e946b1c5848361ec7795838849fafcb976c2b95f145bf2f33d63ba779afe782bc79f4b99d4656b5a37bc9628fb3dbb474e5f69fdc5a26d32f
- SSDEEP
  
  1536:4z44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:4zvokZR/KM/ysjwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan