tinba | bf0ff6fd715c60f5ad270161b0969353ba21c830676409ae8306001cc4bf3583 | Triage

Sharing

General

Target

bf0ff6fd715c60f5ad270161b0969353ba21c830676409ae8306001cc4bf3583N.exe
Size

610KB
Sample

250104-elfnnazqfw
MD5

8cc1805fb7c58616e6a42e6176a18780
SHA1

653536d5cd962c0a4fee82224b88170b2b57f5c7
SHA256

bf0ff6fd715c60f5ad270161b0969353ba21c830676409ae8306001cc4bf3583
SHA512

b8c8fb3b844a07ba0ce5c8b6811d6e300854662951463f7f136229b486ca880b407acdd73f16ffe49271b2637d4b7e44c3f87e112b101527b6a94bd0ee28a1d9
SSDEEP

12288:HATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:NT+KjUdQqboyyWoK1NGqzuhh

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  bf0ff6fd715c60f5ad270161b0969353ba21c830676409ae8306001cc4bf3583N.exe
- Size
  
  610KB
- MD5
  
  8cc1805fb7c58616e6a42e6176a18780
- SHA1
  
  653536d5cd962c0a4fee82224b88170b2b57f5c7
- SHA256
  
  bf0ff6fd715c60f5ad270161b0969353ba21c830676409ae8306001cc4bf3583
- SHA512
  
  b8c8fb3b844a07ba0ce5c8b6811d6e300854662951463f7f136229b486ca880b407acdd73f16ffe49271b2637d4b7e44c3f87e112b101527b6a94bd0ee28a1d9
- SSDEEP
  
  12288:HATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:NT+KjUdQqboyyWoK1NGqzuhh
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2