tinba | b22aa990d67a4d0f1c3d8d6a71d5e1994b9361ccfc74111dd7c87d590dba6197 | Triage

Sharing

General

Target

b22aa990d67a4d0f1c3d8d6a71d5e1994b9361ccfc74111dd7c87d590dba6197N.exe
Size

610KB
Sample

241217-yflr9sxjcr
MD5

48808120b645af685efdee77a1cbb1e0
SHA1

7ed9c42bd5f764e7188fdc0da2e857d7c6e1a835
SHA256

b22aa990d67a4d0f1c3d8d6a71d5e1994b9361ccfc74111dd7c87d590dba6197
SHA512

97e4ba5879d440465803f87093369430626403a637fdc94483dccc0ae1fc0ae7741d65d017578039e30697f02fc34e0b53a58789465219eb015999a45a131638
SSDEEP

12288:BATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:jT+KjUdQqboyyWoK1NGqzuhb

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  b22aa990d67a4d0f1c3d8d6a71d5e1994b9361ccfc74111dd7c87d590dba6197N.exe
- Size
  
  610KB
- MD5
  
  48808120b645af685efdee77a1cbb1e0
- SHA1
  
  7ed9c42bd5f764e7188fdc0da2e857d7c6e1a835
- SHA256
  
  b22aa990d67a4d0f1c3d8d6a71d5e1994b9361ccfc74111dd7c87d590dba6197
- SHA512
  
  97e4ba5879d440465803f87093369430626403a637fdc94483dccc0ae1fc0ae7741d65d017578039e30697f02fc34e0b53a58789465219eb015999a45a131638
- SSDEEP
  
  12288:BATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:jT+KjUdQqboyyWoK1NGqzuhb
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2