tinba | d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b | Triage

Sharing

General

Target

d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe
Size

64KB
Sample

241122-jvcetasqej
MD5

b58497dea9ab8f91ec9c1c82ff8d1bcf
SHA1

dd48add5a7b8144fd8cd7b30b9288be03e52d4c3
SHA256

d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b
SHA512

8ce4de167ff5736c130ba7ef5f6dc464c8db2f913d4455abac0a5e6428cba7357601cf095664d0d931ecbb5fde67404854a873a1c9d72fc807ebb4e7cd4f28c3
SSDEEP

768:w3apPwO6xN5rD8T8X22eEmm6WulSv0yOPh7DuL6uNM6JiqrmehiVurmaBI3VVWI:vPel68XSEmjl/yYrfqjhzrmKIFAI

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe
- Size
  
  64KB
- MD5
  
  b58497dea9ab8f91ec9c1c82ff8d1bcf
- SHA1
  
  dd48add5a7b8144fd8cd7b30b9288be03e52d4c3
- SHA256
  
  d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b
- SHA512
  
  8ce4de167ff5736c130ba7ef5f6dc464c8db2f913d4455abac0a5e6428cba7357601cf095664d0d931ecbb5fde67404854a873a1c9d72fc807ebb4e7cd4f28c3
- SSDEEP
  
  768:w3apPwO6xN5rD8T8X22eEmm6WulSv0yOPh7DuL6uNM6JiqrmehiVurmaBI3VVWI:vPel68XSEmjl/yYrfqjhzrmKIFAI
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan