tinba | 2176097070409d1b4daf983869ec8c6bfd57d300fe360e49fbe55727b0ed5ff0 | Triage

Sharing

General

Target

2176097070409d1b4daf983869ec8c6bfd57d300fe360e49fbe55727b0ed5ff0N
Size

225KB
Sample

241022-ll38aayclg
MD5

3d25d31cd807357b085db8cca8793b20
SHA1

a2efad62a64b6400cd5342151d7b8ec5fd10d2a1
SHA256

2176097070409d1b4daf983869ec8c6bfd57d300fe360e49fbe55727b0ed5ff0
SHA512

13be6b1b40ed484e426279a86dc7f129966e2996f8e1a8dd50c4189a6f5b58a01f7072fb174dc111c5752a9dff7de4a36f35b3aecb8aee95b083d6657d08c55d
SSDEEP

6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  2176097070409d1b4daf983869ec8c6bfd57d300fe360e49fbe55727b0ed5ff0N
- Size
  
  225KB
- MD5
  
  3d25d31cd807357b085db8cca8793b20
- SHA1
  
  a2efad62a64b6400cd5342151d7b8ec5fd10d2a1
- SHA256
  
  2176097070409d1b4daf983869ec8c6bfd57d300fe360e49fbe55727b0ed5ff0
- SHA512
  
  13be6b1b40ed484e426279a86dc7f129966e2996f8e1a8dd50c4189a6f5b58a01f7072fb174dc111c5752a9dff7de4a36f35b3aecb8aee95b083d6657d08c55d
- SSDEEP
  
  6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2