tinba | 41de8de08a5205a1ec73d2df77f48c2c1af4e3f0ebd5f6ed972edfca1c0aeffe | Triage

Sharing

General

Target

41de8de08a5205a1ec73d2df77f48c2c1af4e3f0ebd5f6ed972edfca1c0aeffe.exe
Size

610KB
Sample

241219-k3pwjsylcj
MD5

b7a07a8d9f92d28a4e2244072ec88cae
SHA1

621cfc26e530f797dbf37a33c08a179dc2def842
SHA256

41de8de08a5205a1ec73d2df77f48c2c1af4e3f0ebd5f6ed972edfca1c0aeffe
SHA512

1dd855d5c9542d0a68c7a9d49af7f86214674bbb17104b60d4d8f58dff0be0dbcd668884d2259e8a1202678a38e21d2356c3e72c10bd5416d1b85e3806546b9e
SSDEEP

12288:VATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:/T+KjUdQqboyyWoK1NGqzuhx

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  41de8de08a5205a1ec73d2df77f48c2c1af4e3f0ebd5f6ed972edfca1c0aeffe.exe
- Size
  
  610KB
- MD5
  
  b7a07a8d9f92d28a4e2244072ec88cae
- SHA1
  
  621cfc26e530f797dbf37a33c08a179dc2def842
- SHA256
  
  41de8de08a5205a1ec73d2df77f48c2c1af4e3f0ebd5f6ed972edfca1c0aeffe
- SHA512
  
  1dd855d5c9542d0a68c7a9d49af7f86214674bbb17104b60d4d8f58dff0be0dbcd668884d2259e8a1202678a38e21d2356c3e72c10bd5416d1b85e3806546b9e
- SSDEEP
  
  12288:VATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:/T+KjUdQqboyyWoK1NGqzuhx
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2