tinba | e1717b7128d6e1b17b726cd9adc91357faa04708a040fcf4052d95a0cbc0e4ab | Triage

Sharing

General

Target

e1717b7128d6e1b17b726cd9adc91357faa04708a040fcf4052d95a0cbc0e4abN
Size

98KB
Sample

241006-h8staavfnr
MD5

8c0adebc3f61f5aa84b017b1d03fa230
SHA1

607225827a57d242b396b69a41522057c345be78
SHA256

e1717b7128d6e1b17b726cd9adc91357faa04708a040fcf4052d95a0cbc0e4ab
SHA512

31e9b9625a40c5cc6cd1ae9847f00a25f699c6bee98da0ed1cbac1f75cac26a27ba479411b603e50102e9ca410fcbf8e7cfe2959870c54a8a7df43a94d561dc9
SSDEEP

768:t+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:t+mFM2HXKZgi9Iksu+XM57ipeq9JF

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  e1717b7128d6e1b17b726cd9adc91357faa04708a040fcf4052d95a0cbc0e4abN
- Size
  
  98KB
- MD5
  
  8c0adebc3f61f5aa84b017b1d03fa230
- SHA1
  
  607225827a57d242b396b69a41522057c345be78
- SHA256
  
  e1717b7128d6e1b17b726cd9adc91357faa04708a040fcf4052d95a0cbc0e4ab
- SHA512
  
  31e9b9625a40c5cc6cd1ae9847f00a25f699c6bee98da0ed1cbac1f75cac26a27ba479411b603e50102e9ca410fcbf8e7cfe2959870c54a8a7df43a94d561dc9
- SSDEEP
  
  768:t+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:t+mFM2HXKZgi9Iksu+XM57ipeq9JF
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan