tinba | 81982b0b79f6de1105bf1383cdc5ab800dde52934d03df6eab4934124064860b | Triage

Sharing

General

Target

81982b0b79f6de1105bf1383cdc5ab800dde52934d03df6eab4934124064860bN.exe
Size

225KB
Sample

250108-mqc3bsynck
MD5

91d67de4abd9d9294f22ba11b4101880
SHA1

ddd451c5aede3ad212698d1b8f9dd9527ccfa3b1
SHA256

81982b0b79f6de1105bf1383cdc5ab800dde52934d03df6eab4934124064860b
SHA512

81b5c51c13681ec71340548a17a5081895ae76552548b1b3cbe7f4c348b9d6eb9e3b9395420c8d9c7902d4b3ec4fc6457b8ba2545911f3b38f8ce926e804723f
SSDEEP

6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  81982b0b79f6de1105bf1383cdc5ab800dde52934d03df6eab4934124064860bN.exe
- Size
  
  225KB
- MD5
  
  91d67de4abd9d9294f22ba11b4101880
- SHA1
  
  ddd451c5aede3ad212698d1b8f9dd9527ccfa3b1
- SHA256
  
  81982b0b79f6de1105bf1383cdc5ab800dde52934d03df6eab4934124064860b
- SHA512
  
  81b5c51c13681ec71340548a17a5081895ae76552548b1b3cbe7f4c348b9d6eb9e3b9395420c8d9c7902d4b3ec4fc6457b8ba2545911f3b38f8ce926e804723f
- SSDEEP
  
  6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2