tinba | b73ff0059f7676c1da145948123e43fc395ec93bca856491c1266c2b169d1a71 | Triage

Sharing

General

Target

b73ff0059f7676c1da145948123e43fc395ec93bca856491c1266c2b169d1a71N
Size

135KB
Sample

241020-gq6fzsvdkk
MD5

6f0fa006c0dd486d0f61a251554e15a0
SHA1

f4cd68a6f66bca94b51d545bec93e7c5be4f240a
SHA256

b73ff0059f7676c1da145948123e43fc395ec93bca856491c1266c2b169d1a71
SHA512

4ffde7a9b063e2535b12484a63d269f26430c6e1d5bc7d00b369de69a5adb3dca480b353e7add5695d526c9ccc4ab2fdb111cb4167d6993e7614d6fbd71d6975
SSDEEP

3072:8gr6VutmzgApobYr1fpCjeAaacVoh3EYvp3zoodIy:8q6sEgAmYhfpCCAjNBXd7

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  b73ff0059f7676c1da145948123e43fc395ec93bca856491c1266c2b169d1a71N
- Size
  
  135KB
- MD5
  
  6f0fa006c0dd486d0f61a251554e15a0
- SHA1
  
  f4cd68a6f66bca94b51d545bec93e7c5be4f240a
- SHA256
  
  b73ff0059f7676c1da145948123e43fc395ec93bca856491c1266c2b169d1a71
- SHA512
  
  4ffde7a9b063e2535b12484a63d269f26430c6e1d5bc7d00b369de69a5adb3dca480b353e7add5695d526c9ccc4ab2fdb111cb4167d6993e7614d6fbd71d6975
- SSDEEP
  
  3072:8gr6VutmzgApobYr1fpCjeAaacVoh3EYvp3zoodIy:8q6sEgAmYhfpCCAjNBXd7
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2