tinba | 09db4f27b39d531ae8b2411add06998a29d728231c21f44dace864e2590166c3 | Triage

Sharing

General

Target

09db4f27b39d531ae8b2411add06998a29d728231c21f44dace864e2590166c3
Size

88KB
Sample

241009-w2mwcavhpg
MD5

56d9168cca7917c50e338856e4f7bc10
SHA1

fa1f73e25dbc0916a4d47a96738510207d047dc6
SHA256

09db4f27b39d531ae8b2411add06998a29d728231c21f44dace864e2590166c3
SHA512

cd3f1075081c7c89c355044cabbcd7ff709a0bf31db9bf9a59da8be721ea960bac64f9776f7fe2a703aae22e9f2aba653431ac6022889e43d81050664821d8d5
SSDEEP

1536:kz44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:kzvokZR/KM/ysjwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  09db4f27b39d531ae8b2411add06998a29d728231c21f44dace864e2590166c3
- Size
  
  88KB
- MD5
  
  56d9168cca7917c50e338856e4f7bc10
- SHA1
  
  fa1f73e25dbc0916a4d47a96738510207d047dc6
- SHA256
  
  09db4f27b39d531ae8b2411add06998a29d728231c21f44dace864e2590166c3
- SHA512
  
  cd3f1075081c7c89c355044cabbcd7ff709a0bf31db9bf9a59da8be721ea960bac64f9776f7fe2a703aae22e9f2aba653431ac6022889e43d81050664821d8d5
- SSDEEP
  
  1536:kz44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:kzvokZR/KM/ysjwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan