tinba | bc652ffef8d01ea545d25fb3df55c416dd0f40fafc9281bfc9ef9cc35cf21576 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

5

bc652ffef8...6N.exe

windows7-x64

bc652ffef8...6N.exe

windows10-2004-x64

Sharing

General

Target

bc652ffef8d01ea545d25fb3df55c416dd0f40fafc9281bfc9ef9cc35cf21576N.exe
Size

110KB
Sample

250103-n6rq4avqck
MD5

47b717e34c986f5b93e88872cbfc3950
SHA1

98709fdc999ee801904d2fd8c9f990154c9267de
SHA256

bc652ffef8d01ea545d25fb3df55c416dd0f40fafc9281bfc9ef9cc35cf21576
SHA512

f7b38fdc5342d2b7e994f086f3915297b6660ab0fd942de64c22c54a7bbc42beb7375c89c5f7060fe28be70a0ef352e2ac65838a8467210606ad10c9717539b4
SSDEEP

1536:ziLOvRmmQegJfBbmAQ256/ZrwWnwqjhurmKFcxL8JQ2r0EA:ziyvRmDLs/ZrwWJjAqGcRJ2hA

Score

10^/10

tinba banker discovery persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

bc652ffef8d01ea545d25fb3df55c416dd0f40fafc9281bfc9ef9cc35cf21576N.exe

Resource

win7-20240903-en

tinba banker discovery persistence trojan upx

windows7-x64

8 signatures

120 seconds

Behavioral task

behavioral2

Sample

bc652ffef8d01ea545d25fb3df55c416dd0f40fafc9281bfc9ef9cc35cf21576N.exe

Resource

win10v2004-20241007-en

tinba banker discovery persistence trojan upx

windows10-2004-x64

10 signatures

120 seconds

Malware Config

Targets

- Target
  
  bc652ffef8d01ea545d25fb3df55c416dd0f40fafc9281bfc9ef9cc35cf21576N.exe
- Size
  
  110KB
- MD5
  
  47b717e34c986f5b93e88872cbfc3950
- SHA1
  
  98709fdc999ee801904d2fd8c9f990154c9267de
- SHA256
  
  bc652ffef8d01ea545d25fb3df55c416dd0f40fafc9281bfc9ef9cc35cf21576
- SHA512
  
  f7b38fdc5342d2b7e994f086f3915297b6660ab0fd942de64c22c54a7bbc42beb7375c89c5f7060fe28be70a0ef352e2ac65838a8467210606ad10c9717539b4
- SSDEEP
  
  1536:ziLOvRmmQegJfBbmAQ256/ZrwWnwqjhurmKFcxL8JQ2r0EA:ziyvRmDLs/ZrwWJjAqGcRJ2hA
Score

10^/10

tinba banker discovery persistence trojan upx
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojanupx

behavioral2

tinbabankerdiscoverypersistencetrojanupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.