tinba | 5ceae7ea914b3d5f97a2ea70f4623ed77eac1af0e00c8d307d7c4d594f6d9bbc | Triage

Sharing

General

Target

5ceae7ea914b3d5f97a2ea70f4623ed77eac1af0e00c8d307d7c4d594f6d9bbc.exe
Size

59KB
Sample

241211-h287pasmgw
MD5

1d92a29002459da382064c4050d72985
SHA1

7617c90788dead67ba3a90d22c538e3448f0a9ed
SHA256

5ceae7ea914b3d5f97a2ea70f4623ed77eac1af0e00c8d307d7c4d594f6d9bbc
SHA512

c39ac04c58114e4c02aa82f8ef990c5049265a6e8b5368d35e8c26042bdc2d8d2ee475c6d0f7e299ba6b21150f4f9c7273b4ba9a4f81e7587617d272114288d1
SSDEEP

768:0+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9Jd:0+mFM2HXKZgiFP7xIksu+XM5O9Jd

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  5ceae7ea914b3d5f97a2ea70f4623ed77eac1af0e00c8d307d7c4d594f6d9bbc.exe
- Size
  
  59KB
- MD5
  
  1d92a29002459da382064c4050d72985
- SHA1
  
  7617c90788dead67ba3a90d22c538e3448f0a9ed
- SHA256
  
  5ceae7ea914b3d5f97a2ea70f4623ed77eac1af0e00c8d307d7c4d594f6d9bbc
- SHA512
  
  c39ac04c58114e4c02aa82f8ef990c5049265a6e8b5368d35e8c26042bdc2d8d2ee475c6d0f7e299ba6b21150f4f9c7273b4ba9a4f81e7587617d272114288d1
- SSDEEP
  
  768:0+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9Jd:0+mFM2HXKZgiFP7xIksu+XM5O9Jd
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan