tinba | f84f60353ad0695dd602d49477cb491d06cf5950de48e383aab82736e0312e7c | Triage

Sharing

General

Target

f84f60353ad0695dd602d49477cb491d06cf5950de48e383aab82736e0312e7cN
Size

89KB
Sample

250113-ndwvcasmen
MD5

a6f2bd35d8e1b9e831e0b27292cc0290
SHA1

1d0bb71200aed12f4e4a0d74ae3fa5bb93fef38d
SHA256

f84f60353ad0695dd602d49477cb491d06cf5950de48e383aab82736e0312e7c
SHA512

c2aae9afa26059652d732ced3b8221ebfef8d81e7d05639cfbfa4ba0f96653dcfb03203c6fac837ec87056d736c21206a55386a03affdd5035381c69c5889709
SSDEEP

1536:Wz44CpRkr9DXhH/2m//56RrufqjhzrmKIFAV0E:WzvokZRfN/yFj1qrFAH

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  f84f60353ad0695dd602d49477cb491d06cf5950de48e383aab82736e0312e7cN
- Size
  
  89KB
- MD5
  
  a6f2bd35d8e1b9e831e0b27292cc0290
- SHA1
  
  1d0bb71200aed12f4e4a0d74ae3fa5bb93fef38d
- SHA256
  
  f84f60353ad0695dd602d49477cb491d06cf5950de48e383aab82736e0312e7c
- SHA512
  
  c2aae9afa26059652d732ced3b8221ebfef8d81e7d05639cfbfa4ba0f96653dcfb03203c6fac837ec87056d736c21206a55386a03affdd5035381c69c5889709
- SSDEEP
  
  1536:Wz44CpRkr9DXhH/2m//56RrufqjhzrmKIFAV0E:WzvokZRfN/yFj1qrFAH
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan