tinba | a6648232b08f9522c1bdf7282304eaaa6bd8dd82d9f94cef7c368deb3b619fa1 | Triage

Sharing

General

Target

a6648232b08f9522c1bdf7282304eaaa6bd8dd82d9f94cef7c368deb3b619fa1N
Size

225KB
Sample

240930-s2t3waxara
MD5

05f807605975cc0616a7a1460d928a20
SHA1

249656811b9bd0fa0fcce6016bdd04665f42bf0b
SHA256

a6648232b08f9522c1bdf7282304eaaa6bd8dd82d9f94cef7c368deb3b619fa1
SHA512

6b3451aee6146780295d6852ea428891d4499c76a223b3f2efea7ab820eaeec7fc50883988a297d4753c4d18abed5b0198de939468266222c39f1cedb10ccf9a
SSDEEP

6144:4A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:4ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  a6648232b08f9522c1bdf7282304eaaa6bd8dd82d9f94cef7c368deb3b619fa1N
- Size
  
  225KB
- MD5
  
  05f807605975cc0616a7a1460d928a20
- SHA1
  
  249656811b9bd0fa0fcce6016bdd04665f42bf0b
- SHA256
  
  a6648232b08f9522c1bdf7282304eaaa6bd8dd82d9f94cef7c368deb3b619fa1
- SHA512
  
  6b3451aee6146780295d6852ea428891d4499c76a223b3f2efea7ab820eaeec7fc50883988a297d4753c4d18abed5b0198de939468266222c39f1cedb10ccf9a
- SSDEEP
  
  6144:4A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:4ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2