tinba | 36a79dfd72eb0ab5251f806b68e1696aac52a4e3bf3c9fed0b27cbb46a8b87f7 | Triage

Sharing

General

Target

36a79dfd72eb0ab5251f806b68e1696aac52a4e3bf3c9fed0b27cbb46a8b87f7N.exe
Size

610KB
Sample

241219-la5a7sykfw
MD5

f729e76bc74b8946d00ea94138767550
SHA1

a59181c49a97b091c549c9480d261629324be979
SHA256

36a79dfd72eb0ab5251f806b68e1696aac52a4e3bf3c9fed0b27cbb46a8b87f7
SHA512

2ecc7a24cd378b2800e0ba077bebe7c7753df10bd2ef0338521988b358785fe6d4292f08d017fba6af45a77c87009470981f5d31dd3d6f035ed9a22d47c62a8a
SSDEEP

12288:XATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:dT+KjUdQqboyyWoK1NGqzuhj

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  36a79dfd72eb0ab5251f806b68e1696aac52a4e3bf3c9fed0b27cbb46a8b87f7N.exe
- Size
  
  610KB
- MD5
  
  f729e76bc74b8946d00ea94138767550
- SHA1
  
  a59181c49a97b091c549c9480d261629324be979
- SHA256
  
  36a79dfd72eb0ab5251f806b68e1696aac52a4e3bf3c9fed0b27cbb46a8b87f7
- SHA512
  
  2ecc7a24cd378b2800e0ba077bebe7c7753df10bd2ef0338521988b358785fe6d4292f08d017fba6af45a77c87009470981f5d31dd3d6f035ed9a22d47c62a8a
- SSDEEP
  
  12288:XATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:dT+KjUdQqboyyWoK1NGqzuhj
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2