tinba | d35c3b1dd5c4d0f419a49c3aa71a7db0efd9f80150152c945498d672b9b077e6 | Triage

Sharing

General

Target

d35c3b1dd5c4d0f419a49c3aa71a7db0efd9f80150152c945498d672b9b077e6.exe
Size

225KB
Sample

250108-r77qgstpbz
MD5

6445de36f51a7a68e5b18b67be6befe0
SHA1

7104c9f795a1f58af5a61ad9c78e5eb3fa712d7a
SHA256

d35c3b1dd5c4d0f419a49c3aa71a7db0efd9f80150152c945498d672b9b077e6
SHA512

42d926dc44b6d1249b9062f69cde4b23a942a6fa9e202cb0f29af5bbb3f4e6c6c50f00dca0dcb960a5df2712513542b4617abc7e73334059d8672626cfaea9e7
SSDEEP

6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgP

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  d35c3b1dd5c4d0f419a49c3aa71a7db0efd9f80150152c945498d672b9b077e6.exe
- Size
  
  225KB
- MD5
  
  6445de36f51a7a68e5b18b67be6befe0
- SHA1
  
  7104c9f795a1f58af5a61ad9c78e5eb3fa712d7a
- SHA256
  
  d35c3b1dd5c4d0f419a49c3aa71a7db0efd9f80150152c945498d672b9b077e6
- SHA512
  
  42d926dc44b6d1249b9062f69cde4b23a942a6fa9e202cb0f29af5bbb3f4e6c6c50f00dca0dcb960a5df2712513542b4617abc7e73334059d8672626cfaea9e7
- SSDEEP
  
  6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgP
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2