tinba | 5a108f9a23f98075b5abcb0a378d83e4cabc4c191eb334c8dfbca34e7abc54ce | Triage

Sharing

General

Target

Trojan.Win32.Tinba.GZN.MTB-5a108f9a23f98075b5abcb0a378d83e4cabc4c191eb334c8dfbca34e7abc54ceN
Size

225KB
Sample

240920-fpfcqszgqn
MD5

3bdce816476bf92af5287f3fcb398870
SHA1

a673b5dd870702432f7661b051427d0386bddaa7
SHA256

5a108f9a23f98075b5abcb0a378d83e4cabc4c191eb334c8dfbca34e7abc54ce
SHA512

c546431337249bebc279b588d37cb97ffee0b187164fa31a7b40545fc456a0c6a6c05555b7dc175213da3fb8207b6b4b4881608771a415feee1c5eb18e30a261
SSDEEP

6144:zA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:zATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  Trojan.Win32.Tinba.GZN.MTB-5a108f9a23f98075b5abcb0a378d83e4cabc4c191eb334c8dfbca34e7abc54ceN
- Size
  
  225KB
- MD5
  
  3bdce816476bf92af5287f3fcb398870
- SHA1
  
  a673b5dd870702432f7661b051427d0386bddaa7
- SHA256
  
  5a108f9a23f98075b5abcb0a378d83e4cabc4c191eb334c8dfbca34e7abc54ce
- SHA512
  
  c546431337249bebc279b588d37cb97ffee0b187164fa31a7b40545fc456a0c6a6c05555b7dc175213da3fb8207b6b4b4881608771a415feee1c5eb18e30a261
- SSDEEP
  
  6144:zA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:zATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2