tinba | 68cc719be56bf8a7c7a6a7dc47dd86cb68560c3f8fa96ab95845085a0121d50d | Triage

Sharing

General

Target

68cc719be56bf8a7c7a6a7dc47dd86cb68560c3f8fa96ab95845085a0121d50d
Size

238KB
Sample

250120-d34w5szkcl
MD5

4074984d41db0cfb7526125209eb6d19
SHA1

b031254f31e23fec3a45cdcd2476f81da232df5d
SHA256

68cc719be56bf8a7c7a6a7dc47dd86cb68560c3f8fa96ab95845085a0121d50d
SHA512

a86606d94727c7f10589e3465040e853a445e3993dd3b797839d9c1e4521e94ab90b37e7727bd568858bdb6d693113c2a4f20ffd1a273c873627f58ce25d4e00
SSDEEP

6144:GmkLu0Aq9r8q7XMaC4+yPY7HLgZl3MovMfCp5CR:nkLsq9r8q7Xp27rk3Moa

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  68cc719be56bf8a7c7a6a7dc47dd86cb68560c3f8fa96ab95845085a0121d50d
- Size
  
  238KB
- MD5
  
  4074984d41db0cfb7526125209eb6d19
- SHA1
  
  b031254f31e23fec3a45cdcd2476f81da232df5d
- SHA256
  
  68cc719be56bf8a7c7a6a7dc47dd86cb68560c3f8fa96ab95845085a0121d50d
- SHA512
  
  a86606d94727c7f10589e3465040e853a445e3993dd3b797839d9c1e4521e94ab90b37e7727bd568858bdb6d693113c2a4f20ffd1a273c873627f58ce25d4e00
- SSDEEP
  
  6144:GmkLu0Aq9r8q7XMaC4+yPY7HLgZl3MovMfCp5CR:nkLsq9r8q7Xp27rk3Moa
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2