tinba | 95ec3c9be81b9ee9fe4f1f7eb2a52f666c50da3eb68c915262a228ca330b8e69 | Triage

Sharing

General

Target

95ec3c9be81b9ee9fe4f1f7eb2a52f666c50da3eb68c915262a228ca330b8e69N.exe
Size

225KB
Sample

241129-vzl1laslgq
MD5

b18651eef32a14aa90eea4b8f188a4a0
SHA1

521716a89bf40e7aab5ea63a62781c8236dff727
SHA256

95ec3c9be81b9ee9fe4f1f7eb2a52f666c50da3eb68c915262a228ca330b8e69
SHA512

da1a7baa4fd74dd941e6fa3984e0143bb7ccb417adb7cc17f1d268d57ed7b3fddcd36cc21ccd5158bcfa6ade6cfebb1c7ea12df8d98006d5f109fe9b62a3a67f
SSDEEP

6144:fA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:fATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  95ec3c9be81b9ee9fe4f1f7eb2a52f666c50da3eb68c915262a228ca330b8e69N.exe
- Size
  
  225KB
- MD5
  
  b18651eef32a14aa90eea4b8f188a4a0
- SHA1
  
  521716a89bf40e7aab5ea63a62781c8236dff727
- SHA256
  
  95ec3c9be81b9ee9fe4f1f7eb2a52f666c50da3eb68c915262a228ca330b8e69
- SHA512
  
  da1a7baa4fd74dd941e6fa3984e0143bb7ccb417adb7cc17f1d268d57ed7b3fddcd36cc21ccd5158bcfa6ade6cfebb1c7ea12df8d98006d5f109fe9b62a3a67f
- SSDEEP
  
  6144:fA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:fATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2