tinba | cbdc572edebb2205a2521c5827748bb93a5648937fffd1a1572c63009d9a7724 | Triage

Sharing

General

Target

cbdc572edebb2205a2521c5827748bb93a5648937fffd1a1572c63009d9a7724
Size

225KB
Sample

241223-dw95ksvmhx
MD5

67dd76b5a7ec78a59114642f11e5eff1
SHA1

bad8dc33602c09c8325bdff61a8390b6b8eaa503
SHA256

cbdc572edebb2205a2521c5827748bb93a5648937fffd1a1572c63009d9a7724
SHA512

9b4a8050904ce41b875ef000d4cae26d4d5fe9a8c2222f5cf5275461a8d940bf8016c08528a68a6c8e939afdbbdfae1fdbb3c93d8f9145bc9a07c4823485668f
SSDEEP

6144:yA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:yATuTAnKGwUAW3ycQqgX

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  cbdc572edebb2205a2521c5827748bb93a5648937fffd1a1572c63009d9a7724
- Size
  
  225KB
- MD5
  
  67dd76b5a7ec78a59114642f11e5eff1
- SHA1
  
  bad8dc33602c09c8325bdff61a8390b6b8eaa503
- SHA256
  
  cbdc572edebb2205a2521c5827748bb93a5648937fffd1a1572c63009d9a7724
- SHA512
  
  9b4a8050904ce41b875ef000d4cae26d4d5fe9a8c2222f5cf5275461a8d940bf8016c08528a68a6c8e939afdbbdfae1fdbb3c93d8f9145bc9a07c4823485668f
- SSDEEP
  
  6144:yA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:yATuTAnKGwUAW3ycQqgX
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2