tinba | 4c1171fb10003dc29e1939bca35948d76bae98caf2d586423f457c4616c42470 | Triage

Sharing

General

Target

4c1171fb10003dc29e1939bca35948d76bae98caf2d586423f457c4616c42470N
Size

225KB
Sample

240930-mm42mszgmk
MD5

7b7c0bf6ec6e75f50bcdf03bc1ad9aa0
SHA1

1d1593ae103f8d78b143fbf0e83bc7cfb4e5092f
SHA256

4c1171fb10003dc29e1939bca35948d76bae98caf2d586423f457c4616c42470
SHA512

ec79fb33b303b580756d341c06455e1fdb46b5f774fb4dfc944d28c953938f2b8fa8331ccda47c53e4d317b31bda2496383412c171be9f73be44f6deb37588a5
SSDEEP

6144:kA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:kATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4c1171fb10003dc29e1939bca35948d76bae98caf2d586423f457c4616c42470N
- Size
  
  225KB
- MD5
  
  7b7c0bf6ec6e75f50bcdf03bc1ad9aa0
- SHA1
  
  1d1593ae103f8d78b143fbf0e83bc7cfb4e5092f
- SHA256
  
  4c1171fb10003dc29e1939bca35948d76bae98caf2d586423f457c4616c42470
- SHA512
  
  ec79fb33b303b580756d341c06455e1fdb46b5f774fb4dfc944d28c953938f2b8fa8331ccda47c53e4d317b31bda2496383412c171be9f73be44f6deb37588a5
- SSDEEP
  
  6144:kA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:kATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2