tinba | 8d77f6b051156efc90de2e27453c94e82eb89690e35a78bd32e88b42fb2ca0d5 | Triage

Sharing

General

Target

8d77f6b051156efc90de2e27453c94e82eb89690e35a78bd32e88b42fb2ca0d5
Size

89KB
Sample

241009-ay1r5sthnq
MD5

51b58b58d21db146c235295add50ad7e
SHA1

7b2666892d81413517d5871429d21ff038a35258
SHA256

8d77f6b051156efc90de2e27453c94e82eb89690e35a78bd32e88b42fb2ca0d5
SHA512

ebeadee773a6a9f149c34578777452fd3eec13c8f86d2f233ac70b540852d971692d3ed1b969c420eff2aff7bd59e7b5ddcf2ffc9eafd1e608ab7c35680a7f63
SSDEEP

1536:m9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:m9o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8d77f6b051156efc90de2e27453c94e82eb89690e35a78bd32e88b42fb2ca0d5
- Size
  
  89KB
- MD5
  
  51b58b58d21db146c235295add50ad7e
- SHA1
  
  7b2666892d81413517d5871429d21ff038a35258
- SHA256
  
  8d77f6b051156efc90de2e27453c94e82eb89690e35a78bd32e88b42fb2ca0d5
- SHA512
  
  ebeadee773a6a9f149c34578777452fd3eec13c8f86d2f233ac70b540852d971692d3ed1b969c420eff2aff7bd59e7b5ddcf2ffc9eafd1e608ab7c35680a7f63
- SSDEEP
  
  1536:m9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:m9o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2