tinba | bdfa3207ac8f0debd91466d8b7007748d303b7a9414f11f48787d285d9cbf152 | Triage

Sharing

General

Target

bdfa3207ac8f0debd91466d8b7007748d303b7a9414f11f48787d285d9cbf152.exe
Size

610KB
Sample

241219-hnbz2atqhl
MD5

1d82329fb0dd77eeb56b9151bf1f1a71
SHA1

156598bc987ac6948f424e74b2358d905bef758a
SHA256

bdfa3207ac8f0debd91466d8b7007748d303b7a9414f11f48787d285d9cbf152
SHA512

a704279428d117adf3e971c809bb9ed9313f659428706c0b7fa4cd3ee4b5b2c91ce2518658ccf5890266df2bdc6ef117139250fd8b85ee814096a7b4b5a0fdbc
SSDEEP

12288:KATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:ET+KjUdQqboyyWoK1NGqzuhh

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  bdfa3207ac8f0debd91466d8b7007748d303b7a9414f11f48787d285d9cbf152.exe
- Size
  
  610KB
- MD5
  
  1d82329fb0dd77eeb56b9151bf1f1a71
- SHA1
  
  156598bc987ac6948f424e74b2358d905bef758a
- SHA256
  
  bdfa3207ac8f0debd91466d8b7007748d303b7a9414f11f48787d285d9cbf152
- SHA512
  
  a704279428d117adf3e971c809bb9ed9313f659428706c0b7fa4cd3ee4b5b2c91ce2518658ccf5890266df2bdc6ef117139250fd8b85ee814096a7b4b5a0fdbc
- SSDEEP
  
  12288:KATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:ET+KjUdQqboyyWoK1NGqzuhh
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2