tinba | ae1272f7e45fb056e526e77e1c4ca8f12cd4db57a91e2de0c70185bab678acac | Triage

Sharing

General

Target

ae1272f7e45fb056e526e77e1c4ca8f12cd4db57a91e2de0c70185bab678acac.exe
Size

89KB
Sample

250120-t89mksyqbt
MD5

daa5a258cf31a975068d2aaff4993cb6
SHA1

df34db8a26614c10b68c9ed46e97763f5693272f
SHA256

ae1272f7e45fb056e526e77e1c4ca8f12cd4db57a91e2de0c70185bab678acac
SHA512

802c76232164c3c2a68bb15d6a96299f5c7f4aece0bd8db49e5c8fd4327898f2408dce61c423614cc8c4806fa79f6921cee1b88279acc0ba9f427b41ab0fbea3
SSDEEP

1536:Ez44CpRkr9DXhH/2m//56RrufqjhzrmKIFAV0E7:EzvokZRfN/yFj1qrFAH7

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  ae1272f7e45fb056e526e77e1c4ca8f12cd4db57a91e2de0c70185bab678acac.exe
- Size
  
  89KB
- MD5
  
  daa5a258cf31a975068d2aaff4993cb6
- SHA1
  
  df34db8a26614c10b68c9ed46e97763f5693272f
- SHA256
  
  ae1272f7e45fb056e526e77e1c4ca8f12cd4db57a91e2de0c70185bab678acac
- SHA512
  
  802c76232164c3c2a68bb15d6a96299f5c7f4aece0bd8db49e5c8fd4327898f2408dce61c423614cc8c4806fa79f6921cee1b88279acc0ba9f427b41ab0fbea3
- SSDEEP
  
  1536:Ez44CpRkr9DXhH/2m//56RrufqjhzrmKIFAV0E7:EzvokZRfN/yFj1qrFAH7
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan