tinba | 114c45ad7e21e0d7cad79ba270c23e27248473bbd3b991e7b2956ecb17590147 | Triage

Sharing

General

Target

114c45ad7e21e0d7cad79ba270c23e27248473bbd3b991e7b2956ecb17590147
Size

225KB
Sample

241215-yct98swmfm
MD5

9308e59aec5763a680da9e04626e0a92
SHA1

a049844cc472808c8ca65fb173b9b0712fc274f2
SHA256

114c45ad7e21e0d7cad79ba270c23e27248473bbd3b991e7b2956ecb17590147
SHA512

953482348ee65d2522db775b670675930e5efaff22d552db2a42af36cbc5888b5bd71e5a15c5dd91c3154e347fbae965edeea4de918a210226f88518c4b1066d
SSDEEP

6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  114c45ad7e21e0d7cad79ba270c23e27248473bbd3b991e7b2956ecb17590147
- Size
  
  225KB
- MD5
  
  9308e59aec5763a680da9e04626e0a92
- SHA1
  
  a049844cc472808c8ca65fb173b9b0712fc274f2
- SHA256
  
  114c45ad7e21e0d7cad79ba270c23e27248473bbd3b991e7b2956ecb17590147
- SHA512
  
  953482348ee65d2522db775b670675930e5efaff22d552db2a42af36cbc5888b5bd71e5a15c5dd91c3154e347fbae965edeea4de918a210226f88518c4b1066d
- SSDEEP
  
  6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2