tinba | 0c28917c180ad0b5cac60b933b7b15c4f06345fe6fc61f994702b6b7e6391e70 | Triage

Sharing

General

Target

0c28917c180ad0b5cac60b933b7b15c4f06345fe6fc61f994702b6b7e6391e70.exe
Size

225KB
Sample

241211-m49cpatrej
MD5

c04e74f0c644fb8759ce34259d59dcf4
SHA1

a810f8204b96228eea4e8da5dd2199b567454ccc
SHA256

0c28917c180ad0b5cac60b933b7b15c4f06345fe6fc61f994702b6b7e6391e70
SHA512

e79c428efe55d5403e86bbb096b67781951d466f52cb6a841fb2fea67755ec5fd429d7ace8c584471c8b0e8b3bd39b6a9cbc5cd95ce75e174a003dc19e184d7f
SSDEEP

6144:8A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:8ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  0c28917c180ad0b5cac60b933b7b15c4f06345fe6fc61f994702b6b7e6391e70.exe
- Size
  
  225KB
- MD5
  
  c04e74f0c644fb8759ce34259d59dcf4
- SHA1
  
  a810f8204b96228eea4e8da5dd2199b567454ccc
- SHA256
  
  0c28917c180ad0b5cac60b933b7b15c4f06345fe6fc61f994702b6b7e6391e70
- SHA512
  
  e79c428efe55d5403e86bbb096b67781951d466f52cb6a841fb2fea67755ec5fd429d7ace8c584471c8b0e8b3bd39b6a9cbc5cd95ce75e174a003dc19e184d7f
- SSDEEP
  
  6144:8A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:8ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2