tinba | 6b91466579539adc42dc031b57738db996ad8fbc9d4e8b470150d3018fcc3236 | Triage

Sharing

General

Target

6b91466579539adc42dc031b57738db996ad8fbc9d4e8b470150d3018fcc3236N.exe
Size

610KB
Sample

241204-epgecswpek
MD5

533105c0a25d543a435c301ce8489070
SHA1

8f6c93600623b4c05eff704d05b1894964791acd
SHA256

6b91466579539adc42dc031b57738db996ad8fbc9d4e8b470150d3018fcc3236
SHA512

ba526cac279cca384b487b9c368ff53c9456feb0846441cdee9683031c0b57ee6e6879c8aaf408ce259411ccfcd5cd9687eb01c9f8827e21133c3822b99dd424
SSDEEP

12288:jATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:BT+KjUdQqboyyWoK1NGqzuhj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  6b91466579539adc42dc031b57738db996ad8fbc9d4e8b470150d3018fcc3236N.exe
- Size
  
  610KB
- MD5
  
  533105c0a25d543a435c301ce8489070
- SHA1
  
  8f6c93600623b4c05eff704d05b1894964791acd
- SHA256
  
  6b91466579539adc42dc031b57738db996ad8fbc9d4e8b470150d3018fcc3236
- SHA512
  
  ba526cac279cca384b487b9c368ff53c9456feb0846441cdee9683031c0b57ee6e6879c8aaf408ce259411ccfcd5cd9687eb01c9f8827e21133c3822b99dd424
- SSDEEP
  
  12288:jATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:BT+KjUdQqboyyWoK1NGqzuhj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2