tinba | a7925e898a5d7ee1286ed5e4179fa5003fae015f1e7eb6c073cfb80a1b6d6981 | Triage

Sharing

General

Target

a7925e898a5d7ee1286ed5e4179fa5003fae015f1e7eb6c073cfb80a1b6d6981
Size

237KB
Sample

250116-gbckcswkfp
MD5

3dea45befb436579a7459efdd419dc74
SHA1

d9cdb5208194c2625e410e3f2e836a7a6d2198de
SHA256

a7925e898a5d7ee1286ed5e4179fa5003fae015f1e7eb6c073cfb80a1b6d6981
SHA512

96fe5a8cc4f3adc3c7298b4c4b2492f8e03f1ffa1e0cad572d76af07c8f5a2ba94162893b4d1b860d17efaefe6f93e5434ee3cf71e03000a2be42c6fb1a8fd89
SSDEEP

6144:TA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYA:TATuTAnKGwUAWVycQqgB

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  a7925e898a5d7ee1286ed5e4179fa5003fae015f1e7eb6c073cfb80a1b6d6981
- Size
  
  237KB
- MD5
  
  3dea45befb436579a7459efdd419dc74
- SHA1
  
  d9cdb5208194c2625e410e3f2e836a7a6d2198de
- SHA256
  
  a7925e898a5d7ee1286ed5e4179fa5003fae015f1e7eb6c073cfb80a1b6d6981
- SHA512
  
  96fe5a8cc4f3adc3c7298b4c4b2492f8e03f1ffa1e0cad572d76af07c8f5a2ba94162893b4d1b860d17efaefe6f93e5434ee3cf71e03000a2be42c6fb1a8fd89
- SSDEEP
  
  6144:TA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYA:TATuTAnKGwUAWVycQqgB
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2