tinba | 1e37ebf26ad758cdd065cc3f53130d3d6eda88221015b5ecd564f5f39452c0e7 | Triage

Sharing

General

Target

1e37ebf26ad758cdd065cc3f53130d3d6eda88221015b5ecd564f5f39452c0e7.exe
Size

610KB
Sample

241203-l595yawlhp
MD5

633b90f99a429270a64d612ea65a217f
SHA1

abafa3a8857300e799ca8db7a72751e779fc38a1
SHA256

1e37ebf26ad758cdd065cc3f53130d3d6eda88221015b5ecd564f5f39452c0e7
SHA512

58c748f1a6cc82166f61d7b34bc0ab2eea8d4009ff10a312a0eda1890d88cc97a264d2e982522768380d4779081952463b37b71ac85b27a73f7ad160d335ff8b
SSDEEP

12288:iATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:cT+KjUdQqboyyWoK1NGqzuhL

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  1e37ebf26ad758cdd065cc3f53130d3d6eda88221015b5ecd564f5f39452c0e7.exe
- Size
  
  610KB
- MD5
  
  633b90f99a429270a64d612ea65a217f
- SHA1
  
  abafa3a8857300e799ca8db7a72751e779fc38a1
- SHA256
  
  1e37ebf26ad758cdd065cc3f53130d3d6eda88221015b5ecd564f5f39452c0e7
- SHA512
  
  58c748f1a6cc82166f61d7b34bc0ab2eea8d4009ff10a312a0eda1890d88cc97a264d2e982522768380d4779081952463b37b71ac85b27a73f7ad160d335ff8b
- SSDEEP
  
  12288:iATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:cT+KjUdQqboyyWoK1NGqzuhL
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2