tinba | f349e63ed2e2e1bc4a8b23b5c6e7df2f8167f167eea48e32e0db3f624a00bee5 | Triage

Sharing

General

Target

f349e63ed2e2e1bc4a8b23b5c6e7df2f8167f167eea48e32e0db3f624a00bee5N.exe
Size

225KB
Sample

241205-2mfflswjbx
MD5

4aaf8836715d0492339c677c9863b8a0
SHA1

20a823389c4ef4ab58e25650cf84cf6caaa5efc0
SHA256

f349e63ed2e2e1bc4a8b23b5c6e7df2f8167f167eea48e32e0db3f624a00bee5
SHA512

b1bd28d1324a9c101daf8f13b66c5bbb8bda26a0e94d45281fd28d6aca93f0c642de7015e91fce08b4d311e53b5849efcfadf7762a4c33ed1928670ca75724a5
SSDEEP

6144:hA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:hATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  f349e63ed2e2e1bc4a8b23b5c6e7df2f8167f167eea48e32e0db3f624a00bee5N.exe
- Size
  
  225KB
- MD5
  
  4aaf8836715d0492339c677c9863b8a0
- SHA1
  
  20a823389c4ef4ab58e25650cf84cf6caaa5efc0
- SHA256
  
  f349e63ed2e2e1bc4a8b23b5c6e7df2f8167f167eea48e32e0db3f624a00bee5
- SHA512
  
  b1bd28d1324a9c101daf8f13b66c5bbb8bda26a0e94d45281fd28d6aca93f0c642de7015e91fce08b4d311e53b5849efcfadf7762a4c33ed1928670ca75724a5
- SSDEEP
  
  6144:hA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:hATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2