tinba | 37118c0d61c1b356ee6d3b7f072b27ad9b01ba4b58c00d8c87d8d93d812135bf | Triage

Sharing

General

Target

37118c0d61c1b356ee6d3b7f072b27ad9b01ba4b58c00d8c87d8d93d812135bfN.exe
Size

225KB
Sample

241219-lhzexsyrhn
MD5

da526f29d3d9d9ab1bf074a702b79df0
SHA1

b478544932e414185e54d761c998e758511613de
SHA256

37118c0d61c1b356ee6d3b7f072b27ad9b01ba4b58c00d8c87d8d93d812135bf
SHA512

1a930a878c85b10e5c191db3126cf5021d505f8110b2ee9c11225136a036ff2be707e563b4754b0b79c2f22386eb4d4cc74c563de014d72f2409e05c2f1148f4
SSDEEP

6144:zA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:zATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  37118c0d61c1b356ee6d3b7f072b27ad9b01ba4b58c00d8c87d8d93d812135bfN.exe
- Size
  
  225KB
- MD5
  
  da526f29d3d9d9ab1bf074a702b79df0
- SHA1
  
  b478544932e414185e54d761c998e758511613de
- SHA256
  
  37118c0d61c1b356ee6d3b7f072b27ad9b01ba4b58c00d8c87d8d93d812135bf
- SHA512
  
  1a930a878c85b10e5c191db3126cf5021d505f8110b2ee9c11225136a036ff2be707e563b4754b0b79c2f22386eb4d4cc74c563de014d72f2409e05c2f1148f4
- SSDEEP
  
  6144:zA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:zATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2