tinba | fea28520074bb25549bb3e9d83ce231b68e61aea6eddd6565019ce09da6f99ed | Triage

Sharing

General

Target

fea28520074bb25549bb3e9d83ce231b68e61aea6eddd6565019ce09da6f99edN
Size

88KB
Sample

241002-zc4dksyerb
MD5

f791595931bbd19a1564e8a6911fbb00
SHA1

577aeabc5ab221533a39fa798ef90b2b3ce884ac
SHA256

fea28520074bb25549bb3e9d83ce231b68e61aea6eddd6565019ce09da6f99ed
SHA512

dec6fdf000783fca29a3ac02b73e34352523100055f3b44e9fb9cdc4fce8d4be749ca2a4eb8709d7db23384516912c0cc0464a1f9a570ccb89b2cc64c21b3e04
SSDEEP

1536:kz44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:kzvokZR/KM/ysjwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  fea28520074bb25549bb3e9d83ce231b68e61aea6eddd6565019ce09da6f99edN
- Size
  
  88KB
- MD5
  
  f791595931bbd19a1564e8a6911fbb00
- SHA1
  
  577aeabc5ab221533a39fa798ef90b2b3ce884ac
- SHA256
  
  fea28520074bb25549bb3e9d83ce231b68e61aea6eddd6565019ce09da6f99ed
- SHA512
  
  dec6fdf000783fca29a3ac02b73e34352523100055f3b44e9fb9cdc4fce8d4be749ca2a4eb8709d7db23384516912c0cc0464a1f9a570ccb89b2cc64c21b3e04
- SSDEEP
  
  1536:kz44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:kzvokZR/KM/ysjwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan