tinba | 3bad8f2eba738d0c2a70b878db3d500b31706afb646d526ed02a2f703d7d8c1c | Triage

Sharing

General

Target

3bad8f2eba738d0c2a70b878db3d500b31706afb646d526ed02a2f703d7d8c1c.exe
Size

225KB
Sample

241225-2zls6a1mer
MD5

24df8f7b70c0c5300b36a79d835225df
SHA1

4f228ab18d61584430aa00308a651b04a38edcb7
SHA256

3bad8f2eba738d0c2a70b878db3d500b31706afb646d526ed02a2f703d7d8c1c
SHA512

4046c3f890640ba8832641e7d037a424397941b5357f326df01da4db4003a683adb5da575b9ff9cde0b710a0830d0adaf892b17f32db4a2cf96296895c0d499c
SSDEEP

6144:RA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:RATuTAnKGwUAW3ycQqgt

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  3bad8f2eba738d0c2a70b878db3d500b31706afb646d526ed02a2f703d7d8c1c.exe
- Size
  
  225KB
- MD5
  
  24df8f7b70c0c5300b36a79d835225df
- SHA1
  
  4f228ab18d61584430aa00308a651b04a38edcb7
- SHA256
  
  3bad8f2eba738d0c2a70b878db3d500b31706afb646d526ed02a2f703d7d8c1c
- SHA512
  
  4046c3f890640ba8832641e7d037a424397941b5357f326df01da4db4003a683adb5da575b9ff9cde0b710a0830d0adaf892b17f32db4a2cf96296895c0d499c
- SSDEEP
  
  6144:RA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:RATuTAnKGwUAW3ycQqgt
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2