tinba | ba23cf628b7650dbfe38b3274e9e185fb592f6bb41df6de7dadd8915ae604041 | Triage

Sharing

General

Target

ba23cf628b7650dbfe38b3274e9e185fb592f6bb41df6de7dadd8915ae604041
Size

58KB
Sample

241028-egmw6sxnbp
MD5

b8590487e7ff6483fb65772f35bc95e6
SHA1

fa8556ac91d786007e9803d6d4ccb897cba9306a
SHA256

ba23cf628b7650dbfe38b3274e9e185fb592f6bb41df6de7dadd8915ae604041
SHA512

47fb05c41397064fafc85232da42c2200b739664dbd2bd53cd7a931ebf91710e2b745a630ede12de660cc951c97801ad3d5e8e1d0afa550bab72985db9b927a5
SSDEEP

768:WM5WaKyBevI8OHKA+hmXid6Z9HUEMyerTAzwavKCFC/nGVykmBdwxkpNZsP:V5P2vIg7dNrTAzZv3FaGU5LRm

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  ba23cf628b7650dbfe38b3274e9e185fb592f6bb41df6de7dadd8915ae604041
- Size
  
  58KB
- MD5
  
  b8590487e7ff6483fb65772f35bc95e6
- SHA1
  
  fa8556ac91d786007e9803d6d4ccb897cba9306a
- SHA256
  
  ba23cf628b7650dbfe38b3274e9e185fb592f6bb41df6de7dadd8915ae604041
- SHA512
  
  47fb05c41397064fafc85232da42c2200b739664dbd2bd53cd7a931ebf91710e2b745a630ede12de660cc951c97801ad3d5e8e1d0afa550bab72985db9b927a5
- SSDEEP
  
  768:WM5WaKyBevI8OHKA+hmXid6Z9HUEMyerTAzwavKCFC/nGVykmBdwxkpNZsP:V5P2vIg7dNrTAzZv3FaGU5LRm
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2