tinba | 3b2293df670e80521cb66d5049cd1544270c62364d46c5d35bde6c0f1b59e780 | Triage

Sharing

General

Target

3b2293df670e80521cb66d5049cd1544270c62364d46c5d35bde6c0f1b59e780N.exe
Size

88KB
Sample

241205-bqhf9swrcp
MD5

d667971b686d2852439a03a71e631060
SHA1

77972fe58a9444061ad464c840cd231b634e1c94
SHA256

3b2293df670e80521cb66d5049cd1544270c62364d46c5d35bde6c0f1b59e780
SHA512

cb16d5d59ac70dcb620a8262c9ba40fb89903afbff9f47d592d1fb6743eeb76947315c14dc6e68b5d8023fd07c799f020782147dc494b6674bafa10f3b0f92b0
SSDEEP

1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsNI:25fvp12UFKcD/6jwqWsNI

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  3b2293df670e80521cb66d5049cd1544270c62364d46c5d35bde6c0f1b59e780N.exe
- Size
  
  88KB
- MD5
  
  d667971b686d2852439a03a71e631060
- SHA1
  
  77972fe58a9444061ad464c840cd231b634e1c94
- SHA256
  
  3b2293df670e80521cb66d5049cd1544270c62364d46c5d35bde6c0f1b59e780
- SHA512
  
  cb16d5d59ac70dcb620a8262c9ba40fb89903afbff9f47d592d1fb6743eeb76947315c14dc6e68b5d8023fd07c799f020782147dc494b6674bafa10f3b0f92b0
- SSDEEP
  
  1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsNI:25fvp12UFKcD/6jwqWsNI
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan