tinba | f5f5a2053f61bd483adb0d6fae135a07a1a07582c837d84b4805b9fe04338fd6 | Triage

Sharing

General

Target

f5f5a2053f61bd483adb0d6fae135a07a1a07582c837d84b4805b9fe04338fd6N.exe
Size

225KB
Sample

250119-yjyagasqc1
MD5

2fbae777e4f67aa2e0f57ce06ad8b8f0
SHA1

2ee9688003be5b6f99cc887868a625382c77a130
SHA256

f5f5a2053f61bd483adb0d6fae135a07a1a07582c837d84b4805b9fe04338fd6
SHA512

07b564f15b80b38bc79ee5ad4d3039cdfd7e5a86008857f4c70a71623ec415482d39a2513fb116e4614cd22c004d6bc329dfd3e5c54d3ce51909ea40af8c1879
SSDEEP

6144:PA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:PATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  f5f5a2053f61bd483adb0d6fae135a07a1a07582c837d84b4805b9fe04338fd6N.exe
- Size
  
  225KB
- MD5
  
  2fbae777e4f67aa2e0f57ce06ad8b8f0
- SHA1
  
  2ee9688003be5b6f99cc887868a625382c77a130
- SHA256
  
  f5f5a2053f61bd483adb0d6fae135a07a1a07582c837d84b4805b9fe04338fd6
- SHA512
  
  07b564f15b80b38bc79ee5ad4d3039cdfd7e5a86008857f4c70a71623ec415482d39a2513fb116e4614cd22c004d6bc329dfd3e5c54d3ce51909ea40af8c1879
- SSDEEP
  
  6144:PA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:PATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2