tinba | 2e0f5ed2883bc522928634f5f70e55a39da99cf3a621473dd9b464a5d5416037 | Triage

Sharing

General

Target

2e0f5ed2883bc522928634f5f70e55a39da99cf3a621473dd9b464a5d5416037
Size

68KB
Sample

241004-yvw7jsybqf
MD5

132257dc5fefa131349b48cc67035cbb
SHA1

2115cd94de0939bf027ae2a890a7d3c78507e504
SHA256

2e0f5ed2883bc522928634f5f70e55a39da99cf3a621473dd9b464a5d5416037
SHA512

fa014e6bd1d8f28ff97898e12ddc9fe1fca46e1e9f6188711bee521903e59b6978e022b5efe7bad6c15944cad5a682ab48a1e8ecbda5fc8c54a96f0d2ad2792a
SSDEEP

768:uwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:u47urp3v23HSa0AMNyfQ1d2y4Z4P

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  2e0f5ed2883bc522928634f5f70e55a39da99cf3a621473dd9b464a5d5416037
- Size
  
  68KB
- MD5
  
  132257dc5fefa131349b48cc67035cbb
- SHA1
  
  2115cd94de0939bf027ae2a890a7d3c78507e504
- SHA256
  
  2e0f5ed2883bc522928634f5f70e55a39da99cf3a621473dd9b464a5d5416037
- SHA512
  
  fa014e6bd1d8f28ff97898e12ddc9fe1fca46e1e9f6188711bee521903e59b6978e022b5efe7bad6c15944cad5a682ab48a1e8ecbda5fc8c54a96f0d2ad2792a
- SSDEEP
  
  768:uwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:u47urp3v23HSa0AMNyfQ1d2y4Z4P
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2