tinba | 482adcd21bc3439656ef7c715a92ecc00a3da7522931ea0e67dc941d56b39239 | Triage

Sharing

General

Target

482adcd21bc3439656ef7c715a92ecc00a3da7522931ea0e67dc941d56b39239N
Size

89KB
Sample

241016-zjapva1hpe
MD5

690a6607fd618988298bd02bb31c37f0
SHA1

bac6ddaa84fbab6395c6146cb99c86510db701e3
SHA256

482adcd21bc3439656ef7c715a92ecc00a3da7522931ea0e67dc941d56b39239
SHA512

56887311dd03ff3e9e4ba6a76844b799f76383466ad91d29b21bb4db804747fceef076e9361b991e0f0d50d14934752cfbc136e2563e39b4f95c33c8ef32c15e
SSDEEP

1536:h9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:h9o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  482adcd21bc3439656ef7c715a92ecc00a3da7522931ea0e67dc941d56b39239N
- Size
  
  89KB
- MD5
  
  690a6607fd618988298bd02bb31c37f0
- SHA1
  
  bac6ddaa84fbab6395c6146cb99c86510db701e3
- SHA256
  
  482adcd21bc3439656ef7c715a92ecc00a3da7522931ea0e67dc941d56b39239
- SHA512
  
  56887311dd03ff3e9e4ba6a76844b799f76383466ad91d29b21bb4db804747fceef076e9361b991e0f0d50d14934752cfbc136e2563e39b4f95c33c8ef32c15e
- SSDEEP
  
  1536:h9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:h9o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2