tinba | f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673 | Triage

Sharing

General

Target

f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673N
Size

89KB
Sample

241108-bnm9qs1may
MD5

762e6a229c846620bbbb11fbb6f36290
SHA1

d7c1ec24f3cd7d04076efd2cd9c6feb1450ed6eb
SHA256

f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673
SHA512

1c9b3d44e32b01e58c6805f8fa0f0b13c2a9a8c8e073dd223c3a83a0f731966268a884977e4c139d89e4a81a9edec0b8677e2d9186e2b8de9388e58defbe9264
SSDEEP

1536:k9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:k9o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673N
- Size
  
  89KB
- MD5
  
  762e6a229c846620bbbb11fbb6f36290
- SHA1
  
  d7c1ec24f3cd7d04076efd2cd9c6feb1450ed6eb
- SHA256
  
  f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673
- SHA512
  
  1c9b3d44e32b01e58c6805f8fa0f0b13c2a9a8c8e073dd223c3a83a0f731966268a884977e4c139d89e4a81a9edec0b8677e2d9186e2b8de9388e58defbe9264
- SSDEEP
  
  1536:k9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:k9o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2