tinba | 5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88 | Triage

Sharing

General

Target

5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe
Size

225KB
Sample

241216-k7ddbavmcp
MD5

967acfcc4f07a9386491136a7bf121a0
SHA1

0c3c9a9d28cdf07e2702cd27a96ee2c5b75e5348
SHA256

5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88
SHA512

f2de66e2ff8d2dc3ebb77702a8b8dde424ec33283ad8aa428c8fe6ce3c136b8c052509ba63ed78f603cd803553df222dd03ee3506d122f552ad6199677b67c36
SSDEEP

6144:qA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:qATuTAnKGwUAW3ycQqgl

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88N.exe
- Size
  
  225KB
- MD5
  
  967acfcc4f07a9386491136a7bf121a0
- SHA1
  
  0c3c9a9d28cdf07e2702cd27a96ee2c5b75e5348
- SHA256
  
  5cb67f2fd7cdcd16a79cd33406551d8b344f4b7a97b09b64471bc31bbe467c88
- SHA512
  
  f2de66e2ff8d2dc3ebb77702a8b8dde424ec33283ad8aa428c8fe6ce3c136b8c052509ba63ed78f603cd803553df222dd03ee3506d122f552ad6199677b67c36
- SSDEEP
  
  6144:qA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:qATuTAnKGwUAW3ycQqgl
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2