tinba | 6b44063e2d46431859f99c03a54b4dedbab16814167019571dc7762159af4024 | Triage

Sharing

General

Target

6b44063e2d46431859f99c03a54b4dedbab16814167019571dc7762159af4024N.exe
Size

225KB
Sample

250125-bgdfysxnhs
MD5

a7f5deb3f95185d7f577797d3430b400
SHA1

5d0b20bf10448a1ba1cac960e86bcdba9e4deb27
SHA256

6b44063e2d46431859f99c03a54b4dedbab16814167019571dc7762159af4024
SHA512

707d557e4d03c8c86bd1e4ba54199a31727b3df4a619ae8ee4df037dd62f12fdd7a5d547b9a59ac522ecd26fcbff1a76fbcfd160aa418e65612ebc7243a1ea0c
SSDEEP

6144:IA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:IATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  6b44063e2d46431859f99c03a54b4dedbab16814167019571dc7762159af4024N.exe
- Size
  
  225KB
- MD5
  
  a7f5deb3f95185d7f577797d3430b400
- SHA1
  
  5d0b20bf10448a1ba1cac960e86bcdba9e4deb27
- SHA256
  
  6b44063e2d46431859f99c03a54b4dedbab16814167019571dc7762159af4024
- SHA512
  
  707d557e4d03c8c86bd1e4ba54199a31727b3df4a619ae8ee4df037dd62f12fdd7a5d547b9a59ac522ecd26fcbff1a76fbcfd160aa418e65612ebc7243a1ea0c
- SSDEEP
  
  6144:IA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:IATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2