tinba | eaa388c863a9c94aa757355652daea08b2e2301054d3c1ca20b58976b67b4bb7 | Triage

Sharing

General

Target

eaa388c863a9c94aa757355652daea08b2e2301054d3c1ca20b58976b67b4bb7.exe
Size

89KB
Sample

250224-ntb5wazqv6
MD5

2eedabfc3183f57e7cdbc44daa87edd7
SHA1

015872f9ad67a7ea393f2cb0bc4546c3cc60a334
SHA256

eaa388c863a9c94aa757355652daea08b2e2301054d3c1ca20b58976b67b4bb7
SHA512

779564ce7c33ee86e8c679399f4b1df46e118bfcca38f8b07533b0e6a79ec6009031a187b5ae6339135ef81eedd7f8e12e7568956e99399713ca373b7be3879c
SSDEEP

1536:Y9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA0:Y9o6fK2XqXQwhnHlqQo8Lvy0

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  eaa388c863a9c94aa757355652daea08b2e2301054d3c1ca20b58976b67b4bb7.exe
- Size
  
  89KB
- MD5
  
  2eedabfc3183f57e7cdbc44daa87edd7
- SHA1
  
  015872f9ad67a7ea393f2cb0bc4546c3cc60a334
- SHA256
  
  eaa388c863a9c94aa757355652daea08b2e2301054d3c1ca20b58976b67b4bb7
- SHA512
  
  779564ce7c33ee86e8c679399f4b1df46e118bfcca38f8b07533b0e6a79ec6009031a187b5ae6339135ef81eedd7f8e12e7568956e99399713ca373b7be3879c
- SSDEEP
  
  1536:Y9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA0:Y9o6fK2XqXQwhnHlqQo8Lvy0
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2