tinba | 7c382660fb551401f93f94503c1e2b498ed9bd1c3211ea98a4c137ffd83017fb | Triage

Sharing

General

Target

7c382660fb551401f93f94503c1e2b498ed9bd1c3211ea98a4c137ffd83017fb
Size

225KB
Sample

240927-268lhavbkn
MD5

64680e2f0407181b615e60e7e5359a14
SHA1

a43216e789c5c18f1ac9658b7d5eae05ac33688f
SHA256

7c382660fb551401f93f94503c1e2b498ed9bd1c3211ea98a4c137ffd83017fb
SHA512

84fb8169a202b11d625cea6f42fddc93fb086461e5217903d24039829d4d70ac4d8502510f16d676a702de25b04265fe67486be84ac17df1bacf5bbedcc40b9d
SSDEEP

6144:mA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:mATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  7c382660fb551401f93f94503c1e2b498ed9bd1c3211ea98a4c137ffd83017fb
- Size
  
  225KB
- MD5
  
  64680e2f0407181b615e60e7e5359a14
- SHA1
  
  a43216e789c5c18f1ac9658b7d5eae05ac33688f
- SHA256
  
  7c382660fb551401f93f94503c1e2b498ed9bd1c3211ea98a4c137ffd83017fb
- SHA512
  
  84fb8169a202b11d625cea6f42fddc93fb086461e5217903d24039829d4d70ac4d8502510f16d676a702de25b04265fe67486be84ac17df1bacf5bbedcc40b9d
- SSDEEP
  
  6144:mA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:mATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2