tinba | 4e5312d15fd32d9eee8ffe4c937cb1f3b7c40067ae1e820a8b886772b16f9480 | Triage

Sharing

General

Target

4e5312d15fd32d9eee8ffe4c937cb1f3b7c40067ae1e820a8b886772b16f9480N
Size

237KB
Sample

240919-lxnxqssdne
MD5

4ea52723a3ad8e0159a27cc3c7c40840
SHA1

031691268ad209a8dcd0b23e4ce3cceba20cbb83
SHA256

4e5312d15fd32d9eee8ffe4c937cb1f3b7c40067ae1e820a8b886772b16f9480
SHA512

6c70976d594d22bc01eac22440d8b46bd416189ba48a105f915cf7a5f408e10468ca6ced567884854ce5af5ae0595f26a1bd4f95f31d44aeafb18ea64d579d8a
SSDEEP

6144:7A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:7ATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4e5312d15fd32d9eee8ffe4c937cb1f3b7c40067ae1e820a8b886772b16f9480N
- Size
  
  237KB
- MD5
  
  4ea52723a3ad8e0159a27cc3c7c40840
- SHA1
  
  031691268ad209a8dcd0b23e4ce3cceba20cbb83
- SHA256
  
  4e5312d15fd32d9eee8ffe4c937cb1f3b7c40067ae1e820a8b886772b16f9480
- SHA512
  
  6c70976d594d22bc01eac22440d8b46bd416189ba48a105f915cf7a5f408e10468ca6ced567884854ce5af5ae0595f26a1bd4f95f31d44aeafb18ea64d579d8a
- SSDEEP
  
  6144:7A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:7ATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2