tinba | 5defc72e39ffd63fcb7ce9bbdaaefd7508faaf4506ade0d60ea8e29ac65ae41a | Triage

Sharing

General

Target

5defc72e39ffd63fcb7ce9bbdaaefd7508faaf4506ade0d60ea8e29ac65ae41aN
Size

106KB
Sample

241027-yxxabsyram
MD5

88f8762f0ac4270ce8b7322b82fd8a30
SHA1

8a8ae9fd3e57af8dd86eb799fab4630c7378c212
SHA256

5defc72e39ffd63fcb7ce9bbdaaefd7508faaf4506ade0d60ea8e29ac65ae41a
SHA512

54b663d6d86c512d0feefb2628629f0461c60bf1a1be1d056b70d262adf9ec0fd0ac419d86d789556a1bc8841f4f25c544973dac06fce96221ad1d6d85182a6a
SSDEEP

768:J+6p+OMlgGXCWhfDzU7f0JDgi9I57+sByZ+XsfXpwtG9ipelU9JA:J+mFM2QXtZgi9Iksu+XM57ipeq9JA

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  5defc72e39ffd63fcb7ce9bbdaaefd7508faaf4506ade0d60ea8e29ac65ae41aN
- Size
  
  106KB
- MD5
  
  88f8762f0ac4270ce8b7322b82fd8a30
- SHA1
  
  8a8ae9fd3e57af8dd86eb799fab4630c7378c212
- SHA256
  
  5defc72e39ffd63fcb7ce9bbdaaefd7508faaf4506ade0d60ea8e29ac65ae41a
- SHA512
  
  54b663d6d86c512d0feefb2628629f0461c60bf1a1be1d056b70d262adf9ec0fd0ac419d86d789556a1bc8841f4f25c544973dac06fce96221ad1d6d85182a6a
- SSDEEP
  
  768:J+6p+OMlgGXCWhfDzU7f0JDgi9I57+sByZ+XsfXpwtG9ipelU9JA:J+mFM2QXtZgi9Iksu+XM57ipeq9JA
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan