tinba | dd4e149f231371680f00f7115fc9f38f91987cd28316708db86d90dd8015fdfd | Triage

Sharing

General

Target

dd4e149f231371680f00f7115fc9f38f91987cd28316708db86d90dd8015fdfdN
Size

225KB
Sample

241008-sv716ashjr
MD5

1679acf8cc10c39440925a07c6e98d40
SHA1

2988278905aa4be88cc19fd416f91b57afeb3698
SHA256

dd4e149f231371680f00f7115fc9f38f91987cd28316708db86d90dd8015fdfd
SHA512

529d42c4401c1dc2eca02d3ff1ae2cb9b3d4dc77236265f818202da337869130358fd676d465eaa765ee1cbb26e8246adee9b14bee01a77b65ed01a642e0b290
SSDEEP

6144:WA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:WATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  dd4e149f231371680f00f7115fc9f38f91987cd28316708db86d90dd8015fdfdN
- Size
  
  225KB
- MD5
  
  1679acf8cc10c39440925a07c6e98d40
- SHA1
  
  2988278905aa4be88cc19fd416f91b57afeb3698
- SHA256
  
  dd4e149f231371680f00f7115fc9f38f91987cd28316708db86d90dd8015fdfd
- SHA512
  
  529d42c4401c1dc2eca02d3ff1ae2cb9b3d4dc77236265f818202da337869130358fd676d465eaa765ee1cbb26e8246adee9b14bee01a77b65ed01a642e0b290
- SSDEEP
  
  6144:WA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:WATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2