tinba | ad6d5cd19abe961739f0a72028a39aa7bc00e579b339afc2dc3cd514b52689ca | Triage

Sharing

General

Target

ad6d5cd19abe961739f0a72028a39aa7bc00e579b339afc2dc3cd514b52689caN
Size

225KB
Sample

241004-1gsnbaxemm
MD5

eedfb04968c0c8eab72ba26174a676f0
SHA1

ea9dd983734f3abbc7c354ecc1509d5de4d8de17
SHA256

ad6d5cd19abe961739f0a72028a39aa7bc00e579b339afc2dc3cd514b52689ca
SHA512

06f5be71ca2bf530be5e692a7ecb20ace801c2be000e6dbfd539b2f25f93b8a8abd4f9d1d50466cd3347febcfaa7f910a12524f93e1e373eee16d43dee927d49
SSDEEP

6144:bA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:bATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  ad6d5cd19abe961739f0a72028a39aa7bc00e579b339afc2dc3cd514b52689caN
- Size
  
  225KB
- MD5
  
  eedfb04968c0c8eab72ba26174a676f0
- SHA1
  
  ea9dd983734f3abbc7c354ecc1509d5de4d8de17
- SHA256
  
  ad6d5cd19abe961739f0a72028a39aa7bc00e579b339afc2dc3cd514b52689ca
- SHA512
  
  06f5be71ca2bf530be5e692a7ecb20ace801c2be000e6dbfd539b2f25f93b8a8abd4f9d1d50466cd3347febcfaa7f910a12524f93e1e373eee16d43dee927d49
- SSDEEP
  
  6144:bA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:bATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2