tinba | b97c8064f59473d66e63e545e0044ec12dfccd1de6338e1bc8fa23a67f2de444 | Triage

Sharing

General

Target

b97c8064f59473d66e63e545e0044ec12dfccd1de6338e1bc8fa23a67f2de444
Size

225KB
Sample

241127-ds13ha1mbl
MD5

df0fa950b0fbabeb12813224ed1a8187
SHA1

23cd3abf04a4217ff56bf8d41bdc6326539fe95a
SHA256

b97c8064f59473d66e63e545e0044ec12dfccd1de6338e1bc8fa23a67f2de444
SHA512

bcb82b140335396236d4b2eedf4c10ad4189f9a4df1250455370dbd0541b1544c967680efa35af1d055d498ebf6427f1b51c8fe62dfda00b480caa5a63cb4b0c
SSDEEP

6144:DA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:DATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  b97c8064f59473d66e63e545e0044ec12dfccd1de6338e1bc8fa23a67f2de444
- Size
  
  225KB
- MD5
  
  df0fa950b0fbabeb12813224ed1a8187
- SHA1
  
  23cd3abf04a4217ff56bf8d41bdc6326539fe95a
- SHA256
  
  b97c8064f59473d66e63e545e0044ec12dfccd1de6338e1bc8fa23a67f2de444
- SHA512
  
  bcb82b140335396236d4b2eedf4c10ad4189f9a4df1250455370dbd0541b1544c967680efa35af1d055d498ebf6427f1b51c8fe62dfda00b480caa5a63cb4b0c
- SSDEEP
  
  6144:DA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:DATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2