tinba | dc1e1ceb6262d2014495e2a58b90d63c248e26b1b916ab26ed817e56f0bb0b75 | Triage

Sharing

General

Target

dc1e1ceb6262d2014495e2a58b90d63c248e26b1b916ab26ed817e56f0bb0b75N
Size

225KB
Sample

241005-nepseswclh
MD5

8a1fe1cb51902c8862cddd4f311bb460
SHA1

b643da83cc84871054e36993048ba36911f0ac12
SHA256

dc1e1ceb6262d2014495e2a58b90d63c248e26b1b916ab26ed817e56f0bb0b75
SHA512

65a1063c68872ef81c1a349e15a86465e7d357c265680a4ef00543a358c8c6d527d9c4662530a65149be6bf70ccdebad689b4985a8138d8cb6ce9ca553336a31
SSDEEP

6144:AA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:AATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  dc1e1ceb6262d2014495e2a58b90d63c248e26b1b916ab26ed817e56f0bb0b75N
- Size
  
  225KB
- MD5
  
  8a1fe1cb51902c8862cddd4f311bb460
- SHA1
  
  b643da83cc84871054e36993048ba36911f0ac12
- SHA256
  
  dc1e1ceb6262d2014495e2a58b90d63c248e26b1b916ab26ed817e56f0bb0b75
- SHA512
  
  65a1063c68872ef81c1a349e15a86465e7d357c265680a4ef00543a358c8c6d527d9c4662530a65149be6bf70ccdebad689b4985a8138d8cb6ce9ca553336a31
- SSDEEP
  
  6144:AA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:AATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2