tinba | 4d7f91c4d7d20cfb25ea4b6efb98255f3c5224237cdd4c74b4c8321738478ec3 | Triage

Sharing

General

Target

4d7f91c4d7d20cfb25ea4b6efb98255f3c5224237cdd4c74b4c8321738478ec3
Size

225KB
Sample

250122-awy6jazkdq
MD5

7f873fef35a7958cd107943cea84b35b
SHA1

b0d93c3b8b0110ff6f1284691f6919e4faaf8e30
SHA256

4d7f91c4d7d20cfb25ea4b6efb98255f3c5224237cdd4c74b4c8321738478ec3
SHA512

bbf49a798203923586d9cf3d904b43a0647c6b3875dee1e9a56ad00c8ea3c5fe726fdac82ec25b43ae096562024d5264c2199baf23b0cb222e828e1cbe465644
SSDEEP

6144:AA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:AATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  4d7f91c4d7d20cfb25ea4b6efb98255f3c5224237cdd4c74b4c8321738478ec3
- Size
  
  225KB
- MD5
  
  7f873fef35a7958cd107943cea84b35b
- SHA1
  
  b0d93c3b8b0110ff6f1284691f6919e4faaf8e30
- SHA256
  
  4d7f91c4d7d20cfb25ea4b6efb98255f3c5224237cdd4c74b4c8321738478ec3
- SHA512
  
  bbf49a798203923586d9cf3d904b43a0647c6b3875dee1e9a56ad00c8ea3c5fe726fdac82ec25b43ae096562024d5264c2199baf23b0cb222e828e1cbe465644
- SSDEEP
  
  6144:AA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:AATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2