tinba | d4aa73519cb0b637feacb2c2dcf5518d1ce34dea0c5bf4b4ff78d1218bdf7f58 | Triage

Sharing

General

Target

d4aa73519cb0b637feacb2c2dcf5518d1ce34dea0c5bf4b4ff78d1218bdf7f58.exe
Size

237KB
Sample

241225-1m3epsyrfp
MD5

1a9946c6dba54de26730b1275845a513
SHA1

c325f35835d99847bfb96f8ce40a214d0a9d4b5f
SHA256

d4aa73519cb0b637feacb2c2dcf5518d1ce34dea0c5bf4b4ff78d1218bdf7f58
SHA512

44a32ba72614923e7c3990f45a5f9d9eb4242167f0f59de96b627a3a8eb13c2fa54928b5d66d14c453a0e82641507e9f6e2266f592caff02ea2d0b1292b30360
SSDEEP

6144:gA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYA:gATuTAnKGwUAWVycQqgB

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  d4aa73519cb0b637feacb2c2dcf5518d1ce34dea0c5bf4b4ff78d1218bdf7f58.exe
- Size
  
  237KB
- MD5
  
  1a9946c6dba54de26730b1275845a513
- SHA1
  
  c325f35835d99847bfb96f8ce40a214d0a9d4b5f
- SHA256
  
  d4aa73519cb0b637feacb2c2dcf5518d1ce34dea0c5bf4b4ff78d1218bdf7f58
- SHA512
  
  44a32ba72614923e7c3990f45a5f9d9eb4242167f0f59de96b627a3a8eb13c2fa54928b5d66d14c453a0e82641507e9f6e2266f592caff02ea2d0b1292b30360
- SSDEEP
  
  6144:gA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYA:gATuTAnKGwUAWVycQqgB
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2