tinba | 236396ec53eb739f05595408c48400d8f910f6021191c3f505f4b52dbc3083a5 | Triage

Sharing

General

Target

236396ec53eb739f05595408c48400d8f910f6021191c3f505f4b52dbc3083a5.exe
Size

610KB
Sample

241222-neyekawpal
MD5

5cea6e4fa27712c7f56c7e3efe4056ba
SHA1

6b110b251f3a9f764b6784dfe48a6603bf495344
SHA256

236396ec53eb739f05595408c48400d8f910f6021191c3f505f4b52dbc3083a5
SHA512

a0e874d550417cd6023ef3b4abfe90f088a89464a7c00708002d73098ea6ce6b4e94d230c3401e175c75030a8647ef17b4cd4838fe97cb1331f4a310a40ba1f9
SSDEEP

12288:CATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:8T+KjUdQqboyyWoK1NGqzuhT

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  236396ec53eb739f05595408c48400d8f910f6021191c3f505f4b52dbc3083a5.exe
- Size
  
  610KB
- MD5
  
  5cea6e4fa27712c7f56c7e3efe4056ba
- SHA1
  
  6b110b251f3a9f764b6784dfe48a6603bf495344
- SHA256
  
  236396ec53eb739f05595408c48400d8f910f6021191c3f505f4b52dbc3083a5
- SHA512
  
  a0e874d550417cd6023ef3b4abfe90f088a89464a7c00708002d73098ea6ce6b4e94d230c3401e175c75030a8647ef17b4cd4838fe97cb1331f4a310a40ba1f9
- SSDEEP
  
  12288:CATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:8T+KjUdQqboyyWoK1NGqzuhT
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2