tinba | 8af00449fe6e1672d6d01418150e55021e36e01458ee5bd3ac4b867cf014cded | Triage

Sharing

General

Target

8af00449fe6e1672d6d01418150e55021e36e01458ee5bd3ac4b867cf014cdedN.exe
Size

168KB
Sample

241203-218z3svjgp
MD5

be2c7de34231d1353e36bb6f4399f490
SHA1

3bcd8b1317df5cf61cf38f624a5bfe6b09e69b17
SHA256

8af00449fe6e1672d6d01418150e55021e36e01458ee5bd3ac4b867cf014cded
SHA512

fb90098ac0854b557cd12143ec731b4881efc51f149fbf01d8dc92a3bc658430350f3953de7e0075b71f639829ef29aeca3d8692ba6cdb867f095b617da46336
SSDEEP

3072:R+//K1KJAR6KtqDSB8NojBOryOIy4IwiyO+//K1KJR3l:GKkmVtqWB8NojgrvIy4RiypKkfl

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8af00449fe6e1672d6d01418150e55021e36e01458ee5bd3ac4b867cf014cdedN.exe
- Size
  
  168KB
- MD5
  
  be2c7de34231d1353e36bb6f4399f490
- SHA1
  
  3bcd8b1317df5cf61cf38f624a5bfe6b09e69b17
- SHA256
  
  8af00449fe6e1672d6d01418150e55021e36e01458ee5bd3ac4b867cf014cded
- SHA512
  
  fb90098ac0854b557cd12143ec731b4881efc51f149fbf01d8dc92a3bc658430350f3953de7e0075b71f639829ef29aeca3d8692ba6cdb867f095b617da46336
- SSDEEP
  
  3072:R+//K1KJAR6KtqDSB8NojBOryOIy4IwiyO+//K1KJR3l:GKkmVtqWB8NojgrvIy4RiypKkfl
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan