tinba | 97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8 | Triage

Sharing

General

Target

97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe
Size

237KB
Sample

241231-c5rh6asqgz
MD5

29bb78fa90102178222f44f3356a9a43
SHA1

23dd6a29c1ba2c5f88a25cfdb977758d4c5bde84
SHA256

97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8
SHA512

3f48d25c2fe762e8b1648c454b6c97c8ef9010ecdd73e56d9fa8a4f3ee85b907abb2419dc539da6eed1218edf6d12ab1784ea796a17b888180475a6df3a008f7
SSDEEP

6144:uA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYw:uATuTAnKGwUAWVycQqgb

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe
- Size
  
  237KB
- MD5
  
  29bb78fa90102178222f44f3356a9a43
- SHA1
  
  23dd6a29c1ba2c5f88a25cfdb977758d4c5bde84
- SHA256
  
  97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8
- SHA512
  
  3f48d25c2fe762e8b1648c454b6c97c8ef9010ecdd73e56d9fa8a4f3ee85b907abb2419dc539da6eed1218edf6d12ab1784ea796a17b888180475a6df3a008f7
- SSDEEP
  
  6144:uA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYw:uATuTAnKGwUAWVycQqgb
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2