tinba | 67b67bebc5f6ac0bca3fddac5d5b3b8cb55cf677c0510df0012afe4dd269ab99 | Triage

Sharing

General

Target

67b67bebc5f6ac0bca3fddac5d5b3b8cb55cf677c0510df0012afe4dd269ab99N.exe
Size

610KB
Sample

241112-y1d8xstleq
MD5

7870afe148cebb19609af4b35ea293f0
SHA1

d966c8c3d07857f22b44e999a9958409336f24ae
SHA256

67b67bebc5f6ac0bca3fddac5d5b3b8cb55cf677c0510df0012afe4dd269ab99
SHA512

2c333f0e5312f0dc7d6f971933aab630096d0f97911fd59633618bfeb8c85cf958a7301c145c6eb2ed88638e725cf80b4212a87d2d56b14faff0036b23a57425
SSDEEP

12288:vATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:1T+KjUdQqboyyWoK1NGqzuhb

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  67b67bebc5f6ac0bca3fddac5d5b3b8cb55cf677c0510df0012afe4dd269ab99N.exe
- Size
  
  610KB
- MD5
  
  7870afe148cebb19609af4b35ea293f0
- SHA1
  
  d966c8c3d07857f22b44e999a9958409336f24ae
- SHA256
  
  67b67bebc5f6ac0bca3fddac5d5b3b8cb55cf677c0510df0012afe4dd269ab99
- SHA512
  
  2c333f0e5312f0dc7d6f971933aab630096d0f97911fd59633618bfeb8c85cf958a7301c145c6eb2ed88638e725cf80b4212a87d2d56b14faff0036b23a57425
- SSDEEP
  
  12288:vATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:1T+KjUdQqboyyWoK1NGqzuhb
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2