tinba | 4ecc4bb2987cc9a64a8112701f8579cbfbef97eb30d62c6e494f2876a36cc29a | Triage

Sharing

General

Target

4ecc4bb2987cc9a64a8112701f8579cbfbef97eb30d62c6e494f2876a36cc29aN.exe
Size

59KB
Sample

241127-nenkcsxqbr
MD5

21334ca6fdc7a5a5a654eead9f9099d0
SHA1

fc03a4bd5632d302a19b14ec5d3c3da70603033f
SHA256

4ecc4bb2987cc9a64a8112701f8579cbfbef97eb30d62c6e494f2876a36cc29a
SHA512

aee9bb89e2e619cd795608ac5dc11e8e492a85c61b39d7c6b245fd7e4ef6ddc5b7f6ae344a66a1b4a232d545db2c30c85d31a0236f896d86007eab27ec93b27b
SSDEEP

768:I+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9J1:I+mFM2HXKZgiFP7xIksu+XM5O9J1

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4ecc4bb2987cc9a64a8112701f8579cbfbef97eb30d62c6e494f2876a36cc29aN.exe
- Size
  
  59KB
- MD5
  
  21334ca6fdc7a5a5a654eead9f9099d0
- SHA1
  
  fc03a4bd5632d302a19b14ec5d3c3da70603033f
- SHA256
  
  4ecc4bb2987cc9a64a8112701f8579cbfbef97eb30d62c6e494f2876a36cc29a
- SHA512
  
  aee9bb89e2e619cd795608ac5dc11e8e492a85c61b39d7c6b245fd7e4ef6ddc5b7f6ae344a66a1b4a232d545db2c30c85d31a0236f896d86007eab27ec93b27b
- SSDEEP
  
  768:I+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9J1:I+mFM2HXKZgiFP7xIksu+XM5O9J1
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan