tinba | 239300e9a7e6f2c54457a144f017711fab9f4f952e4e2153cd55df8bc087ff79 | Triage

Sharing

General

Target

239300e9a7e6f2c54457a144f017711fab9f4f952e4e2153cd55df8bc087ff79
Size

59KB
Sample

241103-zj4mxsvbql
MD5

45274c7acfed6128f1228fa0e3def123
SHA1

a926752953599189e50904f0b28bcf6e597e3724
SHA256

239300e9a7e6f2c54457a144f017711fab9f4f952e4e2153cd55df8bc087ff79
SHA512

d5088f7ac56fe7f11502ae9c4ca156b58726620f29a5581ad9b5c81a7dd5838c406f08c9d686947ce5b0e726e7320160c430a751ce3f8f5e62c0ac3b27d1989e
SSDEEP

768:/+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9J1:/+mFM2HXKZgiFP7xIksu+XM5O9J1

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  239300e9a7e6f2c54457a144f017711fab9f4f952e4e2153cd55df8bc087ff79
- Size
  
  59KB
- MD5
  
  45274c7acfed6128f1228fa0e3def123
- SHA1
  
  a926752953599189e50904f0b28bcf6e597e3724
- SHA256
  
  239300e9a7e6f2c54457a144f017711fab9f4f952e4e2153cd55df8bc087ff79
- SHA512
  
  d5088f7ac56fe7f11502ae9c4ca156b58726620f29a5581ad9b5c81a7dd5838c406f08c9d686947ce5b0e726e7320160c430a751ce3f8f5e62c0ac3b27d1989e
- SSDEEP
  
  768:/+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9J1:/+mFM2HXKZgiFP7xIksu+XM5O9J1
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan