tinba | 2f7c5083bd57537adb3f04e5b7f0a81b138c5dd410040bb0be3a0e26905b1975 | Triage

Sharing

General

Target

2f7c5083bd57537adb3f04e5b7f0a81b138c5dd410040bb0be3a0e26905b1975N.exe
Size

225KB
Sample

241216-gmn3jaxket
MD5

f584e18cc65e94f37b31fb0f8ec753f0
SHA1

200da9710322a0589eaf087cae78e50434e40315
SHA256

2f7c5083bd57537adb3f04e5b7f0a81b138c5dd410040bb0be3a0e26905b1975
SHA512

e568dff77201324436334e07a5e6d6a27879d69c599fba25ca2910311baf348f7be3c66b31497a194c6ecf1d8904b449871aaab3ccb4e128e38337c37211509c
SSDEEP

6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  2f7c5083bd57537adb3f04e5b7f0a81b138c5dd410040bb0be3a0e26905b1975N.exe
- Size
  
  225KB
- MD5
  
  f584e18cc65e94f37b31fb0f8ec753f0
- SHA1
  
  200da9710322a0589eaf087cae78e50434e40315
- SHA256
  
  2f7c5083bd57537adb3f04e5b7f0a81b138c5dd410040bb0be3a0e26905b1975
- SHA512
  
  e568dff77201324436334e07a5e6d6a27879d69c599fba25ca2910311baf348f7be3c66b31497a194c6ecf1d8904b449871aaab3ccb4e128e38337c37211509c
- SSDEEP
  
  6144:XA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:XATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2