tinba | 8c2bf95d166e12a791950a8a8faf5b4a900c4c59e6c0d2c23edd80d3290d44be | Triage

Sharing

General

Target

8c2bf95d166e12a791950a8a8faf5b4a900c4c59e6c0d2c23edd80d3290d44be.exe
Size

54KB
Sample

250205-h147caxmak
MD5

a7c1c8ebe581d5c4877ff75b77f7792a
SHA1

6a7c6904d28ce4ed8ad5d340fc8515bde3d92155
SHA256

8c2bf95d166e12a791950a8a8faf5b4a900c4c59e6c0d2c23edd80d3290d44be
SHA512

b76a0b6618fd3f445b37ee4bbd2f9506aee8283a27d9a5f2dc87b8d5071a5901fad103ff7e828ca118b4814cd64f989679fc9cb114c599124522b22fec7d1cfc
SSDEEP

768:F3CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBW:15tPusSRJDTlLTOpJiaDjts4gfFi2+w

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  8c2bf95d166e12a791950a8a8faf5b4a900c4c59e6c0d2c23edd80d3290d44be.exe
- Size
  
  54KB
- MD5
  
  a7c1c8ebe581d5c4877ff75b77f7792a
- SHA1
  
  6a7c6904d28ce4ed8ad5d340fc8515bde3d92155
- SHA256
  
  8c2bf95d166e12a791950a8a8faf5b4a900c4c59e6c0d2c23edd80d3290d44be
- SHA512
  
  b76a0b6618fd3f445b37ee4bbd2f9506aee8283a27d9a5f2dc87b8d5071a5901fad103ff7e828ca118b4814cd64f989679fc9cb114c599124522b22fec7d1cfc
- SSDEEP
  
  768:F3CCRtWM5usSRJDTlLTOpJiqRZNoCRtxihG1gfFNsHWP4jBW:15tPusSRJDTlLTOpJiaDjts4gfFi2+w
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2