tinba | e2673f87d736f2a9e26366c107e1bcc2fdb3ceed0a19905cdb0a6ca3f6b8ade0 | Triage

Sharing

General

Target

e2673f87d736f2a9e26366c107e1bcc2fdb3ceed0a19905cdb0a6ca3f6b8ade0.exe
Size

237KB
Sample

241217-dgv24szjcq
MD5

c015756701f5cc47607249225fbad51e
SHA1

794b2fb7468b0c64d7ecc47c3ed76210b7adf9d9
SHA256

e2673f87d736f2a9e26366c107e1bcc2fdb3ceed0a19905cdb0a6ca3f6b8ade0
SHA512

2ca63c64740e0a18b16ba7c69f0a3f9dcdf8bcfaabdc98461a0d310a3186f790896f82d42c42d4b0120151351d378a30ef6d5def06871d145b5b2f6677826f4c
SSDEEP

6144:sA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYg:sATuTAnKGwUAWVycQqgZ

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  e2673f87d736f2a9e26366c107e1bcc2fdb3ceed0a19905cdb0a6ca3f6b8ade0.exe
- Size
  
  237KB
- MD5
  
  c015756701f5cc47607249225fbad51e
- SHA1
  
  794b2fb7468b0c64d7ecc47c3ed76210b7adf9d9
- SHA256
  
  e2673f87d736f2a9e26366c107e1bcc2fdb3ceed0a19905cdb0a6ca3f6b8ade0
- SHA512
  
  2ca63c64740e0a18b16ba7c69f0a3f9dcdf8bcfaabdc98461a0d310a3186f790896f82d42c42d4b0120151351d378a30ef6d5def06871d145b5b2f6677826f4c
- SSDEEP
  
  6144:sA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYg:sATuTAnKGwUAWVycQqgZ
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2