tinba | dcf8a4c3024c8d489212e7c7b61d8bda427e24d3502e9c1ce1c742639c07eca9 | Triage

Sharing

General

Target

dcf8a4c3024c8d489212e7c7b61d8bda427e24d3502e9c1ce1c742639c07eca9N
Size

89KB
Sample

241009-y7cnnsxfmg
MD5

d660e558de1776fa88e2dcafdd3c0240
SHA1

7da62057d4d2116d936f7174d5698fbec1f30e0c
SHA256

dcf8a4c3024c8d489212e7c7b61d8bda427e24d3502e9c1ce1c742639c07eca9
SHA512

c09dbc8ed031ceb0bff06dcabba4194b5990ddb733beed49d02e1e1aff54f1b7da638b7fc8f446d4b21d07c607115d7eb3078ed76f3244e7d486afb829a7d8de
SSDEEP

1536:19o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:19o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  dcf8a4c3024c8d489212e7c7b61d8bda427e24d3502e9c1ce1c742639c07eca9N
- Size
  
  89KB
- MD5
  
  d660e558de1776fa88e2dcafdd3c0240
- SHA1
  
  7da62057d4d2116d936f7174d5698fbec1f30e0c
- SHA256
  
  dcf8a4c3024c8d489212e7c7b61d8bda427e24d3502e9c1ce1c742639c07eca9
- SHA512
  
  c09dbc8ed031ceb0bff06dcabba4194b5990ddb733beed49d02e1e1aff54f1b7da638b7fc8f446d4b21d07c607115d7eb3078ed76f3244e7d486afb829a7d8de
- SSDEEP
  
  1536:19o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:19o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2