tinba | 8e1c39c7fde2ebf7c5b1b043ecba3b952b711b31c6bbd27cb0db22939bb243cb | Triage

Sharing

General

Target

8e1c39c7fde2ebf7c5b1b043ecba3b952b711b31c6bbd27cb0db22939bb243cb.exe
Size

52KB
Sample

250205-b7snkavlhj
MD5

3301fb890297e49315fb092eaa556fe3
SHA1

995aa489c712ca122128592c326869681211b130
SHA256

8e1c39c7fde2ebf7c5b1b043ecba3b952b711b31c6bbd27cb0db22939bb243cb
SHA512

fbc9d96efe76df7198bde10ec5e415d5aa3f42b8c19b89aae9b7db1ed4ca69526ca4d6b7449c3c1ff3db54dd317f57fdf90fec40286a8b4551e55d0065157b3a
SSDEEP

768:wFJINdDJbjHM+XczWsTtNtS4FOycALGBTg8WLxHUUnGgVPs6FjJl9Jb:OI31jJsJNNr6boUSGgVPsWL9Jb

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8e1c39c7fde2ebf7c5b1b043ecba3b952b711b31c6bbd27cb0db22939bb243cb.exe
- Size
  
  52KB
- MD5
  
  3301fb890297e49315fb092eaa556fe3
- SHA1
  
  995aa489c712ca122128592c326869681211b130
- SHA256
  
  8e1c39c7fde2ebf7c5b1b043ecba3b952b711b31c6bbd27cb0db22939bb243cb
- SHA512
  
  fbc9d96efe76df7198bde10ec5e415d5aa3f42b8c19b89aae9b7db1ed4ca69526ca4d6b7449c3c1ff3db54dd317f57fdf90fec40286a8b4551e55d0065157b3a
- SSDEEP
  
  768:wFJINdDJbjHM+XczWsTtNtS4FOycALGBTg8WLxHUUnGgVPs6FjJl9Jb:OI31jJsJNNr6boUSGgVPsWL9Jb
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan