tinba | 5bf1926f1d96319243febf64c6e94eecd2d100e612bb5c724fc74c164e07bbb0 | Triage

Sharing

General

Target

5bf1926f1d96319243febf64c6e94eecd2d100e612bb5c724fc74c164e07bbb0N.exe
Size

225KB
Sample

241218-kwn1nsskhx
MD5

6e58c7ddff695bb43aa4ba823b6b92a0
SHA1

020b2c70b619e67b2b3a67cab8ffcf5db98cbfb9
SHA256

5bf1926f1d96319243febf64c6e94eecd2d100e612bb5c724fc74c164e07bbb0
SHA512

803db95aaf5541e3f41f1c2e09dc6e9dd3c8f42afb7a6a6d8c00b668ea7094098c5f1a75ede1e07929fd1bd90cf918ee00ecdd533b3a4a313062a7db9da90e16
SSDEEP

6144:7A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:7ATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  5bf1926f1d96319243febf64c6e94eecd2d100e612bb5c724fc74c164e07bbb0N.exe
- Size
  
  225KB
- MD5
  
  6e58c7ddff695bb43aa4ba823b6b92a0
- SHA1
  
  020b2c70b619e67b2b3a67cab8ffcf5db98cbfb9
- SHA256
  
  5bf1926f1d96319243febf64c6e94eecd2d100e612bb5c724fc74c164e07bbb0
- SHA512
  
  803db95aaf5541e3f41f1c2e09dc6e9dd3c8f42afb7a6a6d8c00b668ea7094098c5f1a75ede1e07929fd1bd90cf918ee00ecdd533b3a4a313062a7db9da90e16
- SSDEEP
  
  6144:7A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:7ATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2