tinba | d26cc75e3eec0dede1083d7ad502cad0d51f2f8a7a0c837babb26b66f8626a4b | Triage

Sharing

General

Target

d26cc75e3eec0dede1083d7ad502cad0d51f2f8a7a0c837babb26b66f8626a4b
Size

68KB
Sample

241006-c7ay7azhkl
MD5

46b5edb628c1f11dd02d8e9dda766312
SHA1

cc07daacb7a473ab54bb54f0846c914a1905bec0
SHA256

d26cc75e3eec0dede1083d7ad502cad0d51f2f8a7a0c837babb26b66f8626a4b
SHA512

6d53cc2ce911be47b3c7f506be8e94783db04f075ec93c83ab12225874207fb6012e0c3ae19f108eacce219b5484ebef81be83173b03c5eedb90db4ac2a28c58
SSDEEP

768:zwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:z47urp3v23HSa0AMNyfQ1d2y4Z4P

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  d26cc75e3eec0dede1083d7ad502cad0d51f2f8a7a0c837babb26b66f8626a4b
- Size
  
  68KB
- MD5
  
  46b5edb628c1f11dd02d8e9dda766312
- SHA1
  
  cc07daacb7a473ab54bb54f0846c914a1905bec0
- SHA256
  
  d26cc75e3eec0dede1083d7ad502cad0d51f2f8a7a0c837babb26b66f8626a4b
- SHA512
  
  6d53cc2ce911be47b3c7f506be8e94783db04f075ec93c83ab12225874207fb6012e0c3ae19f108eacce219b5484ebef81be83173b03c5eedb90db4ac2a28c58
- SSDEEP
  
  768:zwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:z47urp3v23HSa0AMNyfQ1d2y4Z4P
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2