tinba | 089e848fd3c729bac358f7bbe3e648cd507b338d6bd74f26ee5f7a4aaa7a5d1c | Triage

Sharing

General

Target

089e848fd3c729bac358f7bbe3e648cd507b338d6bd74f26ee5f7a4aaa7a5d1cN
Size

589KB
Sample

240926-y9x3dszamh
MD5

8be4bf0b6d5b64e102b7d9a34de1f6c0
SHA1

088383efcdb290568ba9a625127b1b0d1e13eec7
SHA256

089e848fd3c729bac358f7bbe3e648cd507b338d6bd74f26ee5f7a4aaa7a5d1c
SHA512

a2f19aa34a026f5cbf03f035fd469fb4a51e810c8ff671f523367b63dfcd8b0a283cf9ad1c44809eeb63008e13d818d2897316c0074a9ea6e0bd31ce2a7407da
SSDEEP

6144:MCE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr63:M6TOUMBQf0ljW2vj7OyzoRaA+ei

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  089e848fd3c729bac358f7bbe3e648cd507b338d6bd74f26ee5f7a4aaa7a5d1cN
- Size
  
  589KB
- MD5
  
  8be4bf0b6d5b64e102b7d9a34de1f6c0
- SHA1
  
  088383efcdb290568ba9a625127b1b0d1e13eec7
- SHA256
  
  089e848fd3c729bac358f7bbe3e648cd507b338d6bd74f26ee5f7a4aaa7a5d1c
- SHA512
  
  a2f19aa34a026f5cbf03f035fd469fb4a51e810c8ff671f523367b63dfcd8b0a283cf9ad1c44809eeb63008e13d818d2897316c0074a9ea6e0bd31ce2a7407da
- SSDEEP
  
  6144:MCE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr63:M6TOUMBQf0ljW2vj7OyzoRaA+ei
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2