tinba | 6e3d474f83c5281f84b5349b40834437f50e9cc65b63c3de0a5931f2b8f18863 | Triage

Sharing

General

Target

6e3d474f83c5281f84b5349b40834437f50e9cc65b63c3de0a5931f2b8f18863N
Size

98KB
Sample

241012-q8hmbaybln
MD5

affc44fbf29c29947b5245594ee03b40
SHA1

60c0d77a8a2a4752852850c0ffc31102ed7a5f33
SHA256

6e3d474f83c5281f84b5349b40834437f50e9cc65b63c3de0a5931f2b8f18863
SHA512

66c09eb201a06922247a7b2364c2165a18bea869da1802cfa94d6f60663ab3a1962d76f73dd5756dd39f30f087ed194b0339478d57cea1148758d12f3fe6af0d
SSDEEP

768:C+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:C+mFM2HXKZgi9Iksu+XM57ipeq9JF

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  6e3d474f83c5281f84b5349b40834437f50e9cc65b63c3de0a5931f2b8f18863N
- Size
  
  98KB
- MD5
  
  affc44fbf29c29947b5245594ee03b40
- SHA1
  
  60c0d77a8a2a4752852850c0ffc31102ed7a5f33
- SHA256
  
  6e3d474f83c5281f84b5349b40834437f50e9cc65b63c3de0a5931f2b8f18863
- SHA512
  
  66c09eb201a06922247a7b2364c2165a18bea869da1802cfa94d6f60663ab3a1962d76f73dd5756dd39f30f087ed194b0339478d57cea1148758d12f3fe6af0d
- SSDEEP
  
  768:C+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:C+mFM2HXKZgi9Iksu+XM57ipeq9JF
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan