tinba | be61e27f5513b63bb32c02e55f17fd9de3c6644434a9c108ba0905a819ab7540 | Triage

Sharing

General

Target

be61e27f5513b63bb32c02e55f17fd9de3c6644434a9c108ba0905a819ab7540N.exe
Size

225KB
Sample

241201-vdk66swncz
MD5

639fb34fd5b62227776e6dd58b30c290
SHA1

53ccc5e3296c53b4dd2a9b6a9fe7fff9fb9bae49
SHA256

be61e27f5513b63bb32c02e55f17fd9de3c6644434a9c108ba0905a819ab7540
SHA512

49650d7f5df0b4d53ffad09c584a1715808e9b9fb3e7e155e03cf2dfa7d2d8e3268e39294c29703e5eb6684c4c0e3553dbe68d34ec6fb3a2f860d7e6f9f6e573
SSDEEP

6144:6A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:6ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  be61e27f5513b63bb32c02e55f17fd9de3c6644434a9c108ba0905a819ab7540N.exe
- Size
  
  225KB
- MD5
  
  639fb34fd5b62227776e6dd58b30c290
- SHA1
  
  53ccc5e3296c53b4dd2a9b6a9fe7fff9fb9bae49
- SHA256
  
  be61e27f5513b63bb32c02e55f17fd9de3c6644434a9c108ba0905a819ab7540
- SHA512
  
  49650d7f5df0b4d53ffad09c584a1715808e9b9fb3e7e155e03cf2dfa7d2d8e3268e39294c29703e5eb6684c4c0e3553dbe68d34ec6fb3a2f860d7e6f9f6e573
- SSDEEP
  
  6144:6A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:6ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2