tinba | 115ccba12be567a99342e1dd686eb3a828d6d33cf4ac3c0e7d3c21565c29b08e | Triage

Sharing

General

Target

115ccba12be567a99342e1dd686eb3a828d6d33cf4ac3c0e7d3c21565c29b08eN.exe
Size

51KB
Sample

250204-x5bsxsykbv
MD5

e8d8bfbdb836314377b5b7fbd3c4f740
SHA1

bf6fbbcd9e59adb620a185c18712323579f2a938
SHA256

115ccba12be567a99342e1dd686eb3a828d6d33cf4ac3c0e7d3c21565c29b08e
SHA512

da83dc2bea46a95fc5713540ef7d4a76046a8c11bb95cc695612e1053dd2417fb00d344705aa40756e57a1f134c42f7fb165322d6ef56f91b2f1218c90d1e6a8
SSDEEP

768:JfrWSEzgqRrBoHxOrwal5RxKwKZOyN/4BxG+C2GqymmcqGncVyR9Jg:JfDEBBoHq7RxgV/twyzEcM9Jg

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  115ccba12be567a99342e1dd686eb3a828d6d33cf4ac3c0e7d3c21565c29b08eN.exe
- Size
  
  51KB
- MD5
  
  e8d8bfbdb836314377b5b7fbd3c4f740
- SHA1
  
  bf6fbbcd9e59adb620a185c18712323579f2a938
- SHA256
  
  115ccba12be567a99342e1dd686eb3a828d6d33cf4ac3c0e7d3c21565c29b08e
- SHA512
  
  da83dc2bea46a95fc5713540ef7d4a76046a8c11bb95cc695612e1053dd2417fb00d344705aa40756e57a1f134c42f7fb165322d6ef56f91b2f1218c90d1e6a8
- SSDEEP
  
  768:JfrWSEzgqRrBoHxOrwal5RxKwKZOyN/4BxG+C2GqymmcqGncVyR9Jg:JfDEBBoHq7RxgV/twyzEcM9Jg
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan