tinba | 0a1557a9f2705d32474eaada9b0665e5127db40e975d9380a9a0be0123b7aa97 | Triage

Sharing

General

Target

0a1557a9f2705d32474eaada9b0665e5127db40e975d9380a9a0be0123b7aa97N.exe
Size

88KB
Sample

241120-fmyfjawncp
MD5

172c9eb81bf51bcfc2b523b7203064d0
SHA1

068fb3d1765892031a88f1c1ada9ef4596618ff5
SHA256

0a1557a9f2705d32474eaada9b0665e5127db40e975d9380a9a0be0123b7aa97
SHA512

376ef061e50cdee76f547ef33c44e9eeb455eaba4f6a70b160b9c3c4b09ac2012d0cda09ac75ffce5dce776fa826f3e14e4688eb9a94eb672ba6f906999b0f73
SSDEEP

1536:Wz44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:WzvokZR/KM/ysjwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  0a1557a9f2705d32474eaada9b0665e5127db40e975d9380a9a0be0123b7aa97N.exe
- Size
  
  88KB
- MD5
  
  172c9eb81bf51bcfc2b523b7203064d0
- SHA1
  
  068fb3d1765892031a88f1c1ada9ef4596618ff5
- SHA256
  
  0a1557a9f2705d32474eaada9b0665e5127db40e975d9380a9a0be0123b7aa97
- SHA512
  
  376ef061e50cdee76f547ef33c44e9eeb455eaba4f6a70b160b9c3c4b09ac2012d0cda09ac75ffce5dce776fa826f3e14e4688eb9a94eb672ba6f906999b0f73
- SSDEEP
  
  1536:Wz44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsN:WzvokZR/KM/ysjwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan