tinba | dcdfc256ce622970e50b8aee8a12b5082baa559b56e75769d0935670fd911f07 | Triage

Sharing

General

Target

dcdfc256ce622970e50b8aee8a12b5082baa559b56e75769d0935670fd911f07.exe
Size

225KB
Sample

241206-dedp2swrat
MD5

ffb5a13e837a13d7e596633917af2106
SHA1

6e306bc63e3cfbefa48a5837786e4ab22623d04e
SHA256

dcdfc256ce622970e50b8aee8a12b5082baa559b56e75769d0935670fd911f07
SHA512

847e50521397d100f97eb20cb92ba3319486776e0e6a37702b6e8845ebff6642995b2f9834b3ab0f33790e93e0bad4ca1301b4a91defbcb6760c87d5438b608d
SSDEEP

6144:LA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:LATuTAnKGwUAW3ycQqg/

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  dcdfc256ce622970e50b8aee8a12b5082baa559b56e75769d0935670fd911f07.exe
- Size
  
  225KB
- MD5
  
  ffb5a13e837a13d7e596633917af2106
- SHA1
  
  6e306bc63e3cfbefa48a5837786e4ab22623d04e
- SHA256
  
  dcdfc256ce622970e50b8aee8a12b5082baa559b56e75769d0935670fd911f07
- SHA512
  
  847e50521397d100f97eb20cb92ba3319486776e0e6a37702b6e8845ebff6642995b2f9834b3ab0f33790e93e0bad4ca1301b4a91defbcb6760c87d5438b608d
- SSDEEP
  
  6144:LA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:LATuTAnKGwUAW3ycQqg/
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2