tinba | b22965ee63e92604da479f3e2a579e15aaef9b54117622c8f1bded4e30eca079 | Triage

Sharing

General

Target

b22965ee63e92604da479f3e2a579e15aaef9b54117622c8f1bded4e30eca079.exe
Size

51KB
Sample

250205-g8z2xswjej
MD5

ee629973c5f3a6db52717987a8ce30f6
SHA1

5060f55cf3f8f83f3aeafbe41a94255026b81b24
SHA256

b22965ee63e92604da479f3e2a579e15aaef9b54117622c8f1bded4e30eca079
SHA512

f9dd74b51bc3c527675bac2093b038ef651b5425b20cb2002f92c90d9dd7e72d801267106f0475084c27ae21d4633310fe7cb12e57c0d835393011a343097f38
SSDEEP

768:JfrWSEzgqRrBoHxOrwal5RxKwKZOyN/4BxG+C2GqymmcqGncVyR9JA:JfDEBBoHq7RxgV/twyzEcM9JA

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  b22965ee63e92604da479f3e2a579e15aaef9b54117622c8f1bded4e30eca079.exe
- Size
  
  51KB
- MD5
  
  ee629973c5f3a6db52717987a8ce30f6
- SHA1
  
  5060f55cf3f8f83f3aeafbe41a94255026b81b24
- SHA256
  
  b22965ee63e92604da479f3e2a579e15aaef9b54117622c8f1bded4e30eca079
- SHA512
  
  f9dd74b51bc3c527675bac2093b038ef651b5425b20cb2002f92c90d9dd7e72d801267106f0475084c27ae21d4633310fe7cb12e57c0d835393011a343097f38
- SSDEEP
  
  768:JfrWSEzgqRrBoHxOrwal5RxKwKZOyN/4BxG+C2GqymmcqGncVyR9JA:JfDEBBoHq7RxgV/twyzEcM9JA
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan