tinba | 1ddc26d81c4ae2a6858e981817613723e50c439fb9acf99486ac2f5afe31e6b2 | Triage

Sharing

General

Target

1ddc26d81c4ae2a6858e981817613723e50c439fb9acf99486ac2f5afe31e6b2
Size

89KB
Sample

241023-xsg46svgla
MD5

3af905c3684d25e597ceb83c57f7d972
SHA1

5e6d20a3ea4adf477b1ed90dec15d0eef45286fc
SHA256

1ddc26d81c4ae2a6858e981817613723e50c439fb9acf99486ac2f5afe31e6b2
SHA512

35218ec6bde271e9d7e6e4e0e6dcb4898c838691d29258cb8d16c5127e1ecaf7ce357db7468205262858c3725a6ef58b0a520af2f22bbf1f059c4fdf794aec77
SSDEEP

1536:I9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:I9o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  1ddc26d81c4ae2a6858e981817613723e50c439fb9acf99486ac2f5afe31e6b2
- Size
  
  89KB
- MD5
  
  3af905c3684d25e597ceb83c57f7d972
- SHA1
  
  5e6d20a3ea4adf477b1ed90dec15d0eef45286fc
- SHA256
  
  1ddc26d81c4ae2a6858e981817613723e50c439fb9acf99486ac2f5afe31e6b2
- SHA512
  
  35218ec6bde271e9d7e6e4e0e6dcb4898c838691d29258cb8d16c5127e1ecaf7ce357db7468205262858c3725a6ef58b0a520af2f22bbf1f059c4fdf794aec77
- SSDEEP
  
  1536:I9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:I9o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2