tinba | cf0da8adacf075faa07782c9d0d83fd6a3b5f4426b3d5b37e39e86fd8311e6fb | Triage

Sharing

General

Target

cf0da8adacf075faa07782c9d0d83fd6a3b5f4426b3d5b37e39e86fd8311e6fb
Size

64KB
Sample

250207-f3g4gszpfy
MD5

e7800bb69cfc99a7eed1bff300e303bd
SHA1

af4c3470bfccc2ceca11d4043f8d99485e1fdbce
SHA256

cf0da8adacf075faa07782c9d0d83fd6a3b5f4426b3d5b37e39e86fd8311e6fb
SHA512

bf89c405a2ecd8d58a2846cad3e65d3b7a53cf08a5a0287e3a13f2ba6140075a6199545759b0f955693ec9c0e932eb9dd0b4678244fbe293f27e83d0197b6be1
SSDEEP

768:QEHsqZKMXc+YcfH0pfdkOy/D+fNR+tEo7om+k/u+dMV5bpqrDOgc9J:8qsMXcOKdkOy7YAtB7Mk/LdMVqA9J

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  cf0da8adacf075faa07782c9d0d83fd6a3b5f4426b3d5b37e39e86fd8311e6fb
- Size
  
  64KB
- MD5
  
  e7800bb69cfc99a7eed1bff300e303bd
- SHA1
  
  af4c3470bfccc2ceca11d4043f8d99485e1fdbce
- SHA256
  
  cf0da8adacf075faa07782c9d0d83fd6a3b5f4426b3d5b37e39e86fd8311e6fb
- SHA512
  
  bf89c405a2ecd8d58a2846cad3e65d3b7a53cf08a5a0287e3a13f2ba6140075a6199545759b0f955693ec9c0e932eb9dd0b4678244fbe293f27e83d0197b6be1
- SSDEEP
  
  768:QEHsqZKMXc+YcfH0pfdkOy/D+fNR+tEo7om+k/u+dMV5bpqrDOgc9J:8qsMXcOKdkOy7YAtB7Mk/LdMVqA9J
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan