tinba | 8c5563edb87de621899d889a20e5c8ed1399699a7527572614f5986b2977d19b | Triage

Sharing

General

Target

8c5563edb87de621899d889a20e5c8ed1399699a7527572614f5986b2977d19b
Size

610KB
Sample

241205-alzdjsylfs
MD5

67407dfb3e0757544c9107c62bf74cac
SHA1

103a3db73dd37cdc2037caee7f9404d53bf9c56d
SHA256

8c5563edb87de621899d889a20e5c8ed1399699a7527572614f5986b2977d19b
SHA512

19d3c4116c9f427c118ebe8d31185fe9eedf593193fbc476aaad9d2e38bb85745ed637cd326f975622d07c2b2bc39aa65d9739a44dac9e058c30ee8a67d12f2d
SSDEEP

12288:LATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:JT+KjUdQqboyyWoK1NGqzuhb

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8c5563edb87de621899d889a20e5c8ed1399699a7527572614f5986b2977d19b
- Size
  
  610KB
- MD5
  
  67407dfb3e0757544c9107c62bf74cac
- SHA1
  
  103a3db73dd37cdc2037caee7f9404d53bf9c56d
- SHA256
  
  8c5563edb87de621899d889a20e5c8ed1399699a7527572614f5986b2977d19b
- SHA512
  
  19d3c4116c9f427c118ebe8d31185fe9eedf593193fbc476aaad9d2e38bb85745ed637cd326f975622d07c2b2bc39aa65d9739a44dac9e058c30ee8a67d12f2d
- SSDEEP
  
  12288:LATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:JT+KjUdQqboyyWoK1NGqzuhb
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2