tinba | 25dd5cf7f5215db3fa348cf082023d9d4a6999ffd8023ec534285cc1d55a22ac | Triage

Sharing

General

Target

25dd5cf7f5215db3fa348cf082023d9d4a6999ffd8023ec534285cc1d55a22ac
Size

610KB
Sample

241201-zcgjtawkel
MD5

9f82c75adfe64310c43bb80640e92b7b
SHA1

f7ede7030daa73ff5c43bf4b98507c838a9cfcc0
SHA256

25dd5cf7f5215db3fa348cf082023d9d4a6999ffd8023ec534285cc1d55a22ac
SHA512

928cc88db7fb7ab1b8ebd3d4696492d24781d091675193a6fdf1a707153741dd4bae4469f955af67c6754b32db2aba3ff154d4b1435ecb0ef1d3996b69c94aae
SSDEEP

12288:fATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:lT+KjUdQqboyyWoK1NGqzuhJ

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  25dd5cf7f5215db3fa348cf082023d9d4a6999ffd8023ec534285cc1d55a22ac
- Size
  
  610KB
- MD5
  
  9f82c75adfe64310c43bb80640e92b7b
- SHA1
  
  f7ede7030daa73ff5c43bf4b98507c838a9cfcc0
- SHA256
  
  25dd5cf7f5215db3fa348cf082023d9d4a6999ffd8023ec534285cc1d55a22ac
- SHA512
  
  928cc88db7fb7ab1b8ebd3d4696492d24781d091675193a6fdf1a707153741dd4bae4469f955af67c6754b32db2aba3ff154d4b1435ecb0ef1d3996b69c94aae
- SSDEEP
  
  12288:fATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:lT+KjUdQqboyyWoK1NGqzuhJ
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2