tinba | c87b9548a8e6beb8d8247163341d170ce330478ec1d14bb0324a6f250bf229f8 | Triage

Sharing

General

Target

c87b9548a8e6beb8d8247163341d170ce330478ec1d14bb0324a6f250bf229f8
Size

225KB
Sample

241217-djg82azjfr
MD5

d9d2c195f15c1b8c0280ccd1caa4d88b
SHA1

8d255762a706337c800c3f3d6942907fb4c17f7a
SHA256

c87b9548a8e6beb8d8247163341d170ce330478ec1d14bb0324a6f250bf229f8
SHA512

f682822fb919d68824207aa4e307906b8c906ffcfcf2301a12b914342cd182f7ca43edf427695d66eb8ab2ce70a11fe20c86b1c2011349cfbf80742bc1ec0f4a
SSDEEP

6144:IA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:IATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  c87b9548a8e6beb8d8247163341d170ce330478ec1d14bb0324a6f250bf229f8
- Size
  
  225KB
- MD5
  
  d9d2c195f15c1b8c0280ccd1caa4d88b
- SHA1
  
  8d255762a706337c800c3f3d6942907fb4c17f7a
- SHA256
  
  c87b9548a8e6beb8d8247163341d170ce330478ec1d14bb0324a6f250bf229f8
- SHA512
  
  f682822fb919d68824207aa4e307906b8c906ffcfcf2301a12b914342cd182f7ca43edf427695d66eb8ab2ce70a11fe20c86b1c2011349cfbf80742bc1ec0f4a
- SSDEEP
  
  6144:IA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:IATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2