tinba | c893c39f0abf20d56bbde820124be8fe00ce635ba72e523eced149e358d33867 | Triage

Sharing

General

Target

c893c39f0abf20d56bbde820124be8fe00ce635ba72e523eced149e358d33867
Size

225KB
Sample

240929-c97qyaxbll
MD5

8370e48e9b3b48d31f094705afbcd939
SHA1

f8994818af61406c893591fd184b4a5acd7c45a9
SHA256

c893c39f0abf20d56bbde820124be8fe00ce635ba72e523eced149e358d33867
SHA512

7c6a7fa5e865d601571a7eedd6d5d238890207cd3431031cae31ebdf46f6a98c21ea7b6cc9c9d22e2b39c759e15b8341f2bcffa607163ec99e4820adbcecea58
SSDEEP

6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  c893c39f0abf20d56bbde820124be8fe00ce635ba72e523eced149e358d33867
- Size
  
  225KB
- MD5
  
  8370e48e9b3b48d31f094705afbcd939
- SHA1
  
  f8994818af61406c893591fd184b4a5acd7c45a9
- SHA256
  
  c893c39f0abf20d56bbde820124be8fe00ce635ba72e523eced149e358d33867
- SHA512
  
  7c6a7fa5e865d601571a7eedd6d5d238890207cd3431031cae31ebdf46f6a98c21ea7b6cc9c9d22e2b39c759e15b8341f2bcffa607163ec99e4820adbcecea58
- SSDEEP
  
  6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2