tinba | 21d7e5843f826e6802821180962290046428053d57567ba889e9e64080492d9c | Triage

Sharing

General

Target

21d7e5843f826e6802821180962290046428053d57567ba889e9e64080492d9cN.exe
Size

90KB
Sample

250205-c1yfxavmgy
MD5

6153661c20757de6b195dfd87d5f65c0
SHA1

e7ff710f7aa3bc8434fb57d0c8b2398a4a243f26
SHA256

21d7e5843f826e6802821180962290046428053d57567ba889e9e64080492d9c
SHA512

8367ee0ada94411673b6f121d30cee39f6c5fa7a610262252cc88b0e15111bea1400067f1271d184a918a859e836971fe6852f7c78e2f515b14ca4b442c1e234
SSDEEP

1536:Fz44CpRkr9DXhHf3aOd/56RrZ7qjh3rmKPNY+o25:FzvokZR/KM/y8jZqMNY/25

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  21d7e5843f826e6802821180962290046428053d57567ba889e9e64080492d9cN.exe
- Size
  
  90KB
- MD5
  
  6153661c20757de6b195dfd87d5f65c0
- SHA1
  
  e7ff710f7aa3bc8434fb57d0c8b2398a4a243f26
- SHA256
  
  21d7e5843f826e6802821180962290046428053d57567ba889e9e64080492d9c
- SHA512
  
  8367ee0ada94411673b6f121d30cee39f6c5fa7a610262252cc88b0e15111bea1400067f1271d184a918a859e836971fe6852f7c78e2f515b14ca4b442c1e234
- SSDEEP
  
  1536:Fz44CpRkr9DXhHf3aOd/56RrZ7qjh3rmKPNY+o25:FzvokZR/KM/y8jZqMNY/25
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan