tinba | 7e200ff586f0396ef01e9f527c1d32908fd56150e6886f5b7927c1cf382d643e | Triage

Sharing

General

Target

8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe
Size

88KB
Sample

241111-qgd5tazend
MD5

10db7b723c7d9344e3b9c09b9222dc4b
SHA1

339feb4b1c134a732ec6f5d3777f52180510e6a9
SHA256

7e200ff586f0396ef01e9f527c1d32908fd56150e6886f5b7927c1cf382d643e
SHA512

fafe71a75ee9b02b1d99fc204e0d893c05c75f90dce8b212a6c4f13548297b18dcde019503e3c0630f624c7a22c756df000afb869e9ab98131050d0ef4f41cb8
SSDEEP

1536:Az44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsNz:AzvokZR/KM/ysjwqWsNz

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe
- Size
  
  88KB
- MD5
  
  10db7b723c7d9344e3b9c09b9222dc4b
- SHA1
  
  339feb4b1c134a732ec6f5d3777f52180510e6a9
- SHA256
  
  7e200ff586f0396ef01e9f527c1d32908fd56150e6886f5b7927c1cf382d643e
- SHA512
  
  fafe71a75ee9b02b1d99fc204e0d893c05c75f90dce8b212a6c4f13548297b18dcde019503e3c0630f624c7a22c756df000afb869e9ab98131050d0ef4f41cb8
- SSDEEP
  
  1536:Az44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsNz:AzvokZR/KM/ysjwqWsNz
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan