tinba | 9fe0812077850229886aa58852af0a8088f2df64bd978df269365c975d2cb920 | Triage

Sharing

General

Target

9fe0812077850229886aa58852af0a8088f2df64bd978df269365c975d2cb920N.exe
Size

237KB
Sample

241123-h7139s1las
MD5

ff64fa8b605b7a3fcc5b4ce94d729670
SHA1

4f15bc5be4ab3ae4774a00766ce4625599010fc2
SHA256

9fe0812077850229886aa58852af0a8088f2df64bd978df269365c975d2cb920
SHA512

782641dec2a4494351d80c157c225074aa8d9170dc2575eebcf7e10eafdea6aa92d839e5ac4e8411a29df256eebe80999c14db1dee81af5d9cc66c39e6b66e46
SSDEEP

6144:CA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:CATuTAnKGwUAWVycQqgj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  9fe0812077850229886aa58852af0a8088f2df64bd978df269365c975d2cb920N.exe
- Size
  
  237KB
- MD5
  
  ff64fa8b605b7a3fcc5b4ce94d729670
- SHA1
  
  4f15bc5be4ab3ae4774a00766ce4625599010fc2
- SHA256
  
  9fe0812077850229886aa58852af0a8088f2df64bd978df269365c975d2cb920
- SHA512
  
  782641dec2a4494351d80c157c225074aa8d9170dc2575eebcf7e10eafdea6aa92d839e5ac4e8411a29df256eebe80999c14db1dee81af5d9cc66c39e6b66e46
- SSDEEP
  
  6144:CA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:CATuTAnKGwUAWVycQqgj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2