tinba | 71dbe9ea4e4a04baf07e77997ffe588613b64fbddd0b3a86a322265c1f8777c5 | Triage

Sharing

General

Target

71dbe9ea4e4a04baf07e77997ffe588613b64fbddd0b3a86a322265c1f8777c5N.exe
Size

610KB
Sample

241130-k64twazpbv
MD5

9ff43693e616dd8e779c1aa593e3c520
SHA1

89d9059e0143763488230b17e9fc97a2c75750cc
SHA256

71dbe9ea4e4a04baf07e77997ffe588613b64fbddd0b3a86a322265c1f8777c5
SHA512

edb9f3928a2983c94658c3f55fa102bcceab742a0ff6f8572b9eb1540c7605c02250fdfd7db1b3ce59fe10acdf851acda6db9d6d4a121a94d22462f5392b2719
SSDEEP

12288:gATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:uT+KjUdQqboyyWoK1NGqzuhx

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  71dbe9ea4e4a04baf07e77997ffe588613b64fbddd0b3a86a322265c1f8777c5N.exe
- Size
  
  610KB
- MD5
  
  9ff43693e616dd8e779c1aa593e3c520
- SHA1
  
  89d9059e0143763488230b17e9fc97a2c75750cc
- SHA256
  
  71dbe9ea4e4a04baf07e77997ffe588613b64fbddd0b3a86a322265c1f8777c5
- SHA512
  
  edb9f3928a2983c94658c3f55fa102bcceab742a0ff6f8572b9eb1540c7605c02250fdfd7db1b3ce59fe10acdf851acda6db9d6d4a121a94d22462f5392b2719
- SSDEEP
  
  12288:gATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:uT+KjUdQqboyyWoK1NGqzuhx
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2