tinba | bf6b758550b1ee2f0dbbe8becd33c65bb1ea8e6c13cf7ef36e9c3212790bcd2b | Triage

Sharing

General

Target

bf6b758550b1ee2f0dbbe8becd33c65bb1ea8e6c13cf7ef36e9c3212790bcd2bN
Size

225KB
Sample

241026-h1ragsyrdz
MD5

06be4ab1c2d73a3ac77ca04b21533230
SHA1

4c34c9eaf766b45c622dd582b6582688023d34bd
SHA256

bf6b758550b1ee2f0dbbe8becd33c65bb1ea8e6c13cf7ef36e9c3212790bcd2b
SHA512

90b9018f2106cb6dcf58e6627e25e7cea65deaf4a58628c47429b9b068f9d2db6f83547a74d72bf4ed5326c7e60baca17a0709340afdd1187db8c61162b85f63
SSDEEP

6144:8A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:8ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  bf6b758550b1ee2f0dbbe8becd33c65bb1ea8e6c13cf7ef36e9c3212790bcd2bN
- Size
  
  225KB
- MD5
  
  06be4ab1c2d73a3ac77ca04b21533230
- SHA1
  
  4c34c9eaf766b45c622dd582b6582688023d34bd
- SHA256
  
  bf6b758550b1ee2f0dbbe8becd33c65bb1ea8e6c13cf7ef36e9c3212790bcd2b
- SHA512
  
  90b9018f2106cb6dcf58e6627e25e7cea65deaf4a58628c47429b9b068f9d2db6f83547a74d72bf4ed5326c7e60baca17a0709340afdd1187db8c61162b85f63
- SSDEEP
  
  6144:8A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:8ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2