tinba | 4c0c2fe6731a8a389b3ef6750bb2f45a60969befb5a979a7672bc4c4f0b99dc1 | Triage

Sharing

General

Target

4c0c2fe6731a8a389b3ef6750bb2f45a60969befb5a979a7672bc4c4f0b99dc1N.exe
Size

225KB
Sample

241216-aq9p3swnfp
MD5

380a7310f54ad3412257294ada95c380
SHA1

79a9f75ce05784a9b80442a07a2b546b979a8a29
SHA256

4c0c2fe6731a8a389b3ef6750bb2f45a60969befb5a979a7672bc4c4f0b99dc1
SHA512

7f0c87ac4844a45f3871fa26fe0079cb0f2206ce7200f3bd7f62a5c113853dcc10e5476eadf108bd8f5d2a93ad57c1dced0fe45ae59a598ad9ed230d6faeeb4c
SSDEEP

6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4c0c2fe6731a8a389b3ef6750bb2f45a60969befb5a979a7672bc4c4f0b99dc1N.exe
- Size
  
  225KB
- MD5
  
  380a7310f54ad3412257294ada95c380
- SHA1
  
  79a9f75ce05784a9b80442a07a2b546b979a8a29
- SHA256
  
  4c0c2fe6731a8a389b3ef6750bb2f45a60969befb5a979a7672bc4c4f0b99dc1
- SHA512
  
  7f0c87ac4844a45f3871fa26fe0079cb0f2206ce7200f3bd7f62a5c113853dcc10e5476eadf108bd8f5d2a93ad57c1dced0fe45ae59a598ad9ed230d6faeeb4c
- SSDEEP
  
  6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2