tinba | a905c980a0c5b5eb018f57de1c33cc9630815b88834e9d24971eb98ea67a637e | Triage

Sharing

General

Target

a905c980a0c5b5eb018f57de1c33cc9630815b88834e9d24971eb98ea67a637eN
Size

68KB
Sample

241004-r6kvbszdpq
MD5

b5db039ad46cf323f9186c17fd8359b0
SHA1

2d2e48a49acc4de4ec6797402cfabbf459df351b
SHA256

a905c980a0c5b5eb018f57de1c33cc9630815b88834e9d24971eb98ea67a637e
SHA512

a21b58ce7e88a9bd39704eea0bfafa7c76f9533aa7bbf3ec4666560abda8488e4de1f3ef11f70e128c7b62f12b8d35fa2ebd71e05b5b436a3f32902e8f074c2e
SSDEEP

768:uwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:u47urp3v23HSa0AMNyfQ1d2y4Z4P

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  a905c980a0c5b5eb018f57de1c33cc9630815b88834e9d24971eb98ea67a637eN
- Size
  
  68KB
- MD5
  
  b5db039ad46cf323f9186c17fd8359b0
- SHA1
  
  2d2e48a49acc4de4ec6797402cfabbf459df351b
- SHA256
  
  a905c980a0c5b5eb018f57de1c33cc9630815b88834e9d24971eb98ea67a637e
- SHA512
  
  a21b58ce7e88a9bd39704eea0bfafa7c76f9533aa7bbf3ec4666560abda8488e4de1f3ef11f70e128c7b62f12b8d35fa2ebd71e05b5b436a3f32902e8f074c2e
- SSDEEP
  
  768:uwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:u47urp3v23HSa0AMNyfQ1d2y4Z4P
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2