tinba | 1eea47e8b382a3e2a9c3890c1ac26d09be8be584a98d80507cbc62fcccc19c80 | Triage

Sharing

General

Target

1eea47e8b382a3e2a9c3890c1ac26d09be8be584a98d80507cbc62fcccc19c80N.exe
Size

225KB
Sample

241205-rppf7ayjgz
MD5

82b83c702e87df6652fc6b832f0b4820
SHA1

1e32dce47a79b6e0dbd05909e86b9b2ecc8b170f
SHA256

1eea47e8b382a3e2a9c3890c1ac26d09be8be584a98d80507cbc62fcccc19c80
SHA512

8591364314af959e9534e11a3698bac84199c12d08fbae1e4feab0f55acaf5de721862d938d8c8501212b6fb901e1b8411188ea70cd2aa1e556b147e1afd14f7
SSDEEP

6144:LA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:LATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  1eea47e8b382a3e2a9c3890c1ac26d09be8be584a98d80507cbc62fcccc19c80N.exe
- Size
  
  225KB
- MD5
  
  82b83c702e87df6652fc6b832f0b4820
- SHA1
  
  1e32dce47a79b6e0dbd05909e86b9b2ecc8b170f
- SHA256
  
  1eea47e8b382a3e2a9c3890c1ac26d09be8be584a98d80507cbc62fcccc19c80
- SHA512
  
  8591364314af959e9534e11a3698bac84199c12d08fbae1e4feab0f55acaf5de721862d938d8c8501212b6fb901e1b8411188ea70cd2aa1e556b147e1afd14f7
- SSDEEP
  
  6144:LA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:LATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2