tinba | 757b5708adf7f77863fc81fed679603c9d58df1eb31db65e1ba3e883788ffb62 | Triage

Sharing

General

Target

757b5708adf7f77863fc81fed679603c9d58df1eb31db65e1ba3e883788ffb62
Size

225KB
Sample

240919-1khyaasblf
MD5

8374d403b822f3f444d9396bc13ff981
SHA1

e0f80c681752ca810410ecaf08f3d3d74aeef7a5
SHA256

757b5708adf7f77863fc81fed679603c9d58df1eb31db65e1ba3e883788ffb62
SHA512

9f53f7995d06268e346e04495c7f5e619132c9d424932dbf25ab6c3e27ec79986230c671cf26e42a5a3bae23806b5d742dbd0108b2b53ac38454f6ea87ea850c
SSDEEP

6144:6A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:6ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  757b5708adf7f77863fc81fed679603c9d58df1eb31db65e1ba3e883788ffb62
- Size
  
  225KB
- MD5
  
  8374d403b822f3f444d9396bc13ff981
- SHA1
  
  e0f80c681752ca810410ecaf08f3d3d74aeef7a5
- SHA256
  
  757b5708adf7f77863fc81fed679603c9d58df1eb31db65e1ba3e883788ffb62
- SHA512
  
  9f53f7995d06268e346e04495c7f5e619132c9d424932dbf25ab6c3e27ec79986230c671cf26e42a5a3bae23806b5d742dbd0108b2b53ac38454f6ea87ea850c
- SSDEEP
  
  6144:6A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:6ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2