tinba | d2aa0f3e94249814cc9df7ce269e58036b8385efb86e1549e4636d2cbda29e7d | Triage

Sharing

General

Target

d2aa0f3e94249814cc9df7ce269e58036b8385efb86e1549e4636d2cbda29e7dN.exe
Size

59KB
Sample

250122-kzr7hayqhk
MD5

e25b134b7675b07a45141cad37b74850
SHA1

57fb6824721fdae88b6d01a0ff4d8a4cc18262b4
SHA256

d2aa0f3e94249814cc9df7ce269e58036b8385efb86e1549e4636d2cbda29e7d
SHA512

1b11e503dabf476267a564943b39d326e73f04ce1dc163144942935edac43edfeff722f787aaf04abbc31f18be17404397865771ede1a1befc7e01f53977cab9
SSDEEP

768:1+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9JF:1+mFM2HXKZgiFP7xIksu+XM5O9JF

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  d2aa0f3e94249814cc9df7ce269e58036b8385efb86e1549e4636d2cbda29e7dN.exe
- Size
  
  59KB
- MD5
  
  e25b134b7675b07a45141cad37b74850
- SHA1
  
  57fb6824721fdae88b6d01a0ff4d8a4cc18262b4
- SHA256
  
  d2aa0f3e94249814cc9df7ce269e58036b8385efb86e1549e4636d2cbda29e7d
- SHA512
  
  1b11e503dabf476267a564943b39d326e73f04ce1dc163144942935edac43edfeff722f787aaf04abbc31f18be17404397865771ede1a1befc7e01f53977cab9
- SSDEEP
  
  768:1+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9JF:1+mFM2HXKZgiFP7xIksu+XM5O9JF
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan