tinba | c904b17422b8f295017d999b3ccc4e6f9d56ee811184a2d51795717cbbb41021 | Triage

Sharing

General

Target

c904b17422b8f295017d999b3ccc4e6f9d56ee811184a2d51795717cbbb41021.exe
Size

49KB
Sample

250205-q324rsymfx
MD5

e424c4dc36c4e23aaa999e6dccf46bb6
SHA1

348571756ae25c3d3555db7708945a62faea443a
SHA256

c904b17422b8f295017d999b3ccc4e6f9d56ee811184a2d51795717cbbb41021
SHA512

203a901a87a27cb51273abc5771e80248b8fa2bd022857ac7dd8417622437abbd6936e48f9d6251a43989792690226afee25e8f68d63582e46c17b569cd15a6a
SSDEEP

768:EY9XSIMHJ3frSSVRpUvVfaG+3flG1Eq/mxO64g/CWCcO5ZFtR9Jx:Duu0056flS5/Z64gqcO5ZFv9Jx

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  c904b17422b8f295017d999b3ccc4e6f9d56ee811184a2d51795717cbbb41021.exe
- Size
  
  49KB
- MD5
  
  e424c4dc36c4e23aaa999e6dccf46bb6
- SHA1
  
  348571756ae25c3d3555db7708945a62faea443a
- SHA256
  
  c904b17422b8f295017d999b3ccc4e6f9d56ee811184a2d51795717cbbb41021
- SHA512
  
  203a901a87a27cb51273abc5771e80248b8fa2bd022857ac7dd8417622437abbd6936e48f9d6251a43989792690226afee25e8f68d63582e46c17b569cd15a6a
- SSDEEP
  
  768:EY9XSIMHJ3frSSVRpUvVfaG+3flG1Eq/mxO64g/CWCcO5ZFtR9Jx:Duu0056flS5/Z64gqcO5ZFv9Jx
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan