tinba | 8fb2a5f4f90fa87cc1642ba6cf3b7af8ab0ccc16745f85796e0523ad93e6dd2e | Triage

Sharing

General

Target

8fb2a5f4f90fa87cc1642ba6cf3b7af8ab0ccc16745f85796e0523ad93e6dd2e.exe
Size

225KB
Sample

250116-klts6ssqhp
MD5

c70bd7ce7254511d31b802e677bc1022
SHA1

1e1d4429e57b85f7210bb2bab8dedcb6cfcd1ca9
SHA256

8fb2a5f4f90fa87cc1642ba6cf3b7af8ab0ccc16745f85796e0523ad93e6dd2e
SHA512

42c22a328260b714457a637ec4724cfca5900db3a4c5b0d2d5a4dc0a837333ea58c946e69c4b42c85d82b3d0f601b9a5d10ef63726e3114db48ac51679e323e6
SSDEEP

6144:pA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:pATuTAnKGwUAW3ycQqg9

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8fb2a5f4f90fa87cc1642ba6cf3b7af8ab0ccc16745f85796e0523ad93e6dd2e.exe
- Size
  
  225KB
- MD5
  
  c70bd7ce7254511d31b802e677bc1022
- SHA1
  
  1e1d4429e57b85f7210bb2bab8dedcb6cfcd1ca9
- SHA256
  
  8fb2a5f4f90fa87cc1642ba6cf3b7af8ab0ccc16745f85796e0523ad93e6dd2e
- SHA512
  
  42c22a328260b714457a637ec4724cfca5900db3a4c5b0d2d5a4dc0a837333ea58c946e69c4b42c85d82b3d0f601b9a5d10ef63726e3114db48ac51679e323e6
- SSDEEP
  
  6144:pA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:pATuTAnKGwUAW3ycQqg9
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2