tinba | 64b1c5989ef8073d5339ff620b44b36aa4ba80b4e209af4c6f3dbde2ce640ca9 | Triage

Sharing

General

Target

64b1c5989ef8073d5339ff620b44b36aa4ba80b4e209af4c6f3dbde2ce640ca9N.exe
Size

610KB
Sample

241222-lxb8yatlcy
MD5

a8d913d04725db712bcfe78bd0c3cac0
SHA1

54406f60bff653ac223c9ad32426419c8d5556a4
SHA256

64b1c5989ef8073d5339ff620b44b36aa4ba80b4e209af4c6f3dbde2ce640ca9
SHA512

199c92358127296d79c812a243624b7ef038be1b4f9ebeae9e58e22483e2f75f4dfd6a03547e2c211a28b12906a37c99616ed04d76c015a5df841360ee55bc7a
SSDEEP

12288:CATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:8T+KjUdQqboyyWoK1NGqzuhh

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  64b1c5989ef8073d5339ff620b44b36aa4ba80b4e209af4c6f3dbde2ce640ca9N.exe
- Size
  
  610KB
- MD5
  
  a8d913d04725db712bcfe78bd0c3cac0
- SHA1
  
  54406f60bff653ac223c9ad32426419c8d5556a4
- SHA256
  
  64b1c5989ef8073d5339ff620b44b36aa4ba80b4e209af4c6f3dbde2ce640ca9
- SHA512
  
  199c92358127296d79c812a243624b7ef038be1b4f9ebeae9e58e22483e2f75f4dfd6a03547e2c211a28b12906a37c99616ed04d76c015a5df841360ee55bc7a
- SSDEEP
  
  12288:CATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:8T+KjUdQqboyyWoK1NGqzuhh
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2