tinba | 5c69e3dd1d417337b55f2206f5864f0fcfb8d680d830ca492a39db5aad4f9183 | Triage

Sharing

General

Target

5c69e3dd1d417337b55f2206f5864f0fcfb8d680d830ca492a39db5aad4f9183.exe
Size

237KB
Sample

241202-rrz1pssrhn
MD5

3399bdc1e66258c7c7e29be80f490f29
SHA1

ed2656ced30af44fb819c570b7d75ec7156f98ad
SHA256

5c69e3dd1d417337b55f2206f5864f0fcfb8d680d830ca492a39db5aad4f9183
SHA512

d8e3738eb2d796c96b281785782a9f5589ada11a8441f952e67010e2ebf2d34b1270935f797381dc4a7b9feeb25e7fb6f08baa680a7d7690ae9209876ffcc20d
SSDEEP

6144:hA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYA:hATuTAnKGwUAWVycQqgR

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  5c69e3dd1d417337b55f2206f5864f0fcfb8d680d830ca492a39db5aad4f9183.exe
- Size
  
  237KB
- MD5
  
  3399bdc1e66258c7c7e29be80f490f29
- SHA1
  
  ed2656ced30af44fb819c570b7d75ec7156f98ad
- SHA256
  
  5c69e3dd1d417337b55f2206f5864f0fcfb8d680d830ca492a39db5aad4f9183
- SHA512
  
  d8e3738eb2d796c96b281785782a9f5589ada11a8441f952e67010e2ebf2d34b1270935f797381dc4a7b9feeb25e7fb6f08baa680a7d7690ae9209876ffcc20d
- SSDEEP
  
  6144:hA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYA:hATuTAnKGwUAWVycQqgR
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2