tinba | ccc33ccb0d57f405899be5b62bce00d3210861e29667cd5c5dd39bb80eaa6619 | Triage

Sharing

General

Target

ccc33ccb0d57f405899be5b62bce00d3210861e29667cd5c5dd39bb80eaa6619.exe
Size

225KB
Sample

250125-afyvtsxkgm
MD5

3c346f9952d15cade6d522c338a22171
SHA1

374f79de122b508df1c498eb077df78e90e2e085
SHA256

ccc33ccb0d57f405899be5b62bce00d3210861e29667cd5c5dd39bb80eaa6619
SHA512

7666ae8b0fadafad9775e1241580eed1b8c5b73b422be8056fd75cae535db2cfbd534a884635d56dabd9ec16f5d375f064d0a77e3b72d354d638abcb5d209256
SSDEEP

6144:RA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:RATuTAnKGwUAW3ycQqgX

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  ccc33ccb0d57f405899be5b62bce00d3210861e29667cd5c5dd39bb80eaa6619.exe
- Size
  
  225KB
- MD5
  
  3c346f9952d15cade6d522c338a22171
- SHA1
  
  374f79de122b508df1c498eb077df78e90e2e085
- SHA256
  
  ccc33ccb0d57f405899be5b62bce00d3210861e29667cd5c5dd39bb80eaa6619
- SHA512
  
  7666ae8b0fadafad9775e1241580eed1b8c5b73b422be8056fd75cae535db2cfbd534a884635d56dabd9ec16f5d375f064d0a77e3b72d354d638abcb5d209256
- SSDEEP
  
  6144:RA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:RATuTAnKGwUAW3ycQqgX
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2