tinba | 5234eb2a98df716c496dbee0cc340507108fb6ea6713208dfbb64e1dcf08d9ac | Triage

Sharing

General

Target

5234eb2a98df716c496dbee0cc340507108fb6ea6713208dfbb64e1dcf08d9acN
Size

68KB
Sample

241010-qt7ynatbpk
MD5

10f38fc9ef777a3ab142e52309aea200
SHA1

83f723bd477e2277296e2687da4921c41e37cd1d
SHA256

5234eb2a98df716c496dbee0cc340507108fb6ea6713208dfbb64e1dcf08d9ac
SHA512

38ab252fb6364cb2f8b2456e20128b315a464dda526ccd97737f6ec6085b6730b5dc2bd4b576263ef62a16bad86d005f2890c1fecf5825e99e4e4e2b9d5abb3f
SSDEEP

768:BwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:B47urp3v23HSa0AMNyfQ1d2y4Z4P

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  5234eb2a98df716c496dbee0cc340507108fb6ea6713208dfbb64e1dcf08d9acN
- Size
  
  68KB
- MD5
  
  10f38fc9ef777a3ab142e52309aea200
- SHA1
  
  83f723bd477e2277296e2687da4921c41e37cd1d
- SHA256
  
  5234eb2a98df716c496dbee0cc340507108fb6ea6713208dfbb64e1dcf08d9ac
- SHA512
  
  38ab252fb6364cb2f8b2456e20128b315a464dda526ccd97737f6ec6085b6730b5dc2bd4b576263ef62a16bad86d005f2890c1fecf5825e99e4e4e2b9d5abb3f
- SSDEEP
  
  768:BwaGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:B47urp3v23HSa0AMNyfQ1d2y4Z4P
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2