tinba | 001b1eb14f2033dba270a7b48700bb2acd7d8a7bffd75ed64cc7b28f9b3ad775 | Triage

Sharing

General

Target

001b1eb14f2033dba270a7b48700bb2acd7d8a7bffd75ed64cc7b28f9b3ad775N.exe
Size

98KB
Sample

241226-je38lazpel
MD5

16b392bac458d6d35b3f185ba0067570
SHA1

b77aa8a2ecde49b34ffb0af7dd98f2e7315d4ad4
SHA256

001b1eb14f2033dba270a7b48700bb2acd7d8a7bffd75ed64cc7b28f9b3ad775
SHA512

d131f9d837972f075a075ce654905b3e698d2a309624692b08e52f4de450c9e2aa81277e61470052c0de1ca71aad3c0a3fa9de579f6fe5bfe3b0eb98d3717978
SSDEEP

768:X+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:X+mFM2HXKZgi9Iksu+XM57ipeq9JF

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  001b1eb14f2033dba270a7b48700bb2acd7d8a7bffd75ed64cc7b28f9b3ad775N.exe
- Size
  
  98KB
- MD5
  
  16b392bac458d6d35b3f185ba0067570
- SHA1
  
  b77aa8a2ecde49b34ffb0af7dd98f2e7315d4ad4
- SHA256
  
  001b1eb14f2033dba270a7b48700bb2acd7d8a7bffd75ed64cc7b28f9b3ad775
- SHA512
  
  d131f9d837972f075a075ce654905b3e698d2a309624692b08e52f4de450c9e2aa81277e61470052c0de1ca71aad3c0a3fa9de579f6fe5bfe3b0eb98d3717978
- SSDEEP
  
  768:X+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:X+mFM2HXKZgi9Iksu+XM57ipeq9JF
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan