tinba | f5dc98192c45cd8d9afbc0f1e59ea93164aebab8aa7a3dfc0f1a78d1956db8e1 | Triage

Sharing

General

Target

f5dc98192c45cd8d9afbc0f1e59ea93164aebab8aa7a3dfc0f1a78d1956db8e1N.exe
Size

89KB
Sample

241119-z25ypssnbz
MD5

1f65366ce515f030ca88131b275add20
SHA1

60406145f3ab42a45ad9d96b2be0df99fe94d353
SHA256

f5dc98192c45cd8d9afbc0f1e59ea93164aebab8aa7a3dfc0f1a78d1956db8e1
SHA512

aad7a7957abb303ff8f219a97794971145fb05efb7a27addd9c255acdca16580bdf5f3788d55c042244371ec7204bf60cae2dfda243dd66d7db9178b9842092a
SSDEEP

1536:T9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:T9o6fK2XqXQwhnHlqQo8Lvy

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  f5dc98192c45cd8d9afbc0f1e59ea93164aebab8aa7a3dfc0f1a78d1956db8e1N.exe
- Size
  
  89KB
- MD5
  
  1f65366ce515f030ca88131b275add20
- SHA1
  
  60406145f3ab42a45ad9d96b2be0df99fe94d353
- SHA256
  
  f5dc98192c45cd8d9afbc0f1e59ea93164aebab8aa7a3dfc0f1a78d1956db8e1
- SHA512
  
  aad7a7957abb303ff8f219a97794971145fb05efb7a27addd9c255acdca16580bdf5f3788d55c042244371ec7204bf60cae2dfda243dd66d7db9178b9842092a
- SSDEEP
  
  1536:T9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:T9o6fK2XqXQwhnHlqQo8Lvy
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2