tinba | 6eb24ff3983676ab1344dbfc7a74142c978cb25380e9770f52f3e25acd3a6ea7 | Triage

Sharing

General

Target

6eb24ff3983676ab1344dbfc7a74142c978cb25380e9770f52f3e25acd3a6ea7N
Size

225KB
Sample

241001-nx5xcsxfql
MD5

8569ae1244c1aa2acaabd3cb85b5b7f0
SHA1

0f0b342ed929f4ff179a86ce3482d753c665684b
SHA256

6eb24ff3983676ab1344dbfc7a74142c978cb25380e9770f52f3e25acd3a6ea7
SHA512

08b38e1a1034916138f3d767ba49f5203976ef7ba7077e3f4ceddd3649a8abeb20ffc511dccb275a1069cb64600685efd3872d066962a146496e1a04a572c7d6
SSDEEP

6144:wA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:wATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  6eb24ff3983676ab1344dbfc7a74142c978cb25380e9770f52f3e25acd3a6ea7N
- Size
  
  225KB
- MD5
  
  8569ae1244c1aa2acaabd3cb85b5b7f0
- SHA1
  
  0f0b342ed929f4ff179a86ce3482d753c665684b
- SHA256
  
  6eb24ff3983676ab1344dbfc7a74142c978cb25380e9770f52f3e25acd3a6ea7
- SHA512
  
  08b38e1a1034916138f3d767ba49f5203976ef7ba7077e3f4ceddd3649a8abeb20ffc511dccb275a1069cb64600685efd3872d066962a146496e1a04a572c7d6
- SSDEEP
  
  6144:wA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:wATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2