tinba | bfb29356c5d85dd674bf84afc62daddd7749d1dc9c058e655aaca0b9d23bb0d2 | Triage

Sharing

General

Target

bfb29356c5d85dd674bf84afc62daddd7749d1dc9c058e655aaca0b9d23bb0d2N
Size

237KB
Sample

240922-aj1tlascnn
MD5

782fe3f6ebba922c31b53aa33f4d8980
SHA1

1b1f33c05c916e6b45af23f96ac540dcf40b939d
SHA256

bfb29356c5d85dd674bf84afc62daddd7749d1dc9c058e655aaca0b9d23bb0d2
SHA512

a8c6aaecf66094661153e8f61aa36daf563e8b77e679b2301765912037c61c1a6e93ed6b001a12705b3f546efc3005505db74105a274b7a5e9ae4c27a43fbfef
SSDEEP

6144:2A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:2ATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  bfb29356c5d85dd674bf84afc62daddd7749d1dc9c058e655aaca0b9d23bb0d2N
- Size
  
  237KB
- MD5
  
  782fe3f6ebba922c31b53aa33f4d8980
- SHA1
  
  1b1f33c05c916e6b45af23f96ac540dcf40b939d
- SHA256
  
  bfb29356c5d85dd674bf84afc62daddd7749d1dc9c058e655aaca0b9d23bb0d2
- SHA512
  
  a8c6aaecf66094661153e8f61aa36daf563e8b77e679b2301765912037c61c1a6e93ed6b001a12705b3f546efc3005505db74105a274b7a5e9ae4c27a43fbfef
- SSDEEP
  
  6144:2A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:2ATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2