MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Tinba


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b
SHA3-384 hash: 22445828bbe9ecaf354dbae1529e96828f4ec7ca0172a36c0f2eab3a7a9638be04460bba352a3d3139db3751ef72e686
SHA1 hash: 721c35ed0fe50d49af6db7d6c5026539fc6b405e
MD5 hash: 9d745e442275c7c4b5ec8b5493fc81c8
humanhash: pip-virginia-juliet-zebra
File name:fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b
Download: download sample
Signature Tinba
Create hunting rule
File size:155'648 bytes
First seen:2020-06-10 11:34:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cf7043279dfd2cb8583c9e8617b8e02a (2 x Tinba)
ssdeep 1536:e6myQm5x9jSp42U/35fK6q+vMoGMaK9aWLwbOB0QQiz:zn3Wy2w5fK6tvFt9aW+Ozfz
Threatray 347 similar samples on MalwareBazaar
TLSH 36E3C55AB006A418D85FEB7B46D259AF71BBDEB498C800673969BF033335148D84BD8F
Reporter JAMESWT_WT
Tags:Tinba

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'066
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Tinba-6940063-0
Create hunting rule

Win.Trojan.Hupigon-6940099-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Tinba
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 16:08:36 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7sycb7ecpp2de6jp53yta2hibffobxi7eap2hgfdmdxm6yqwmmfq._file
Verdict:
malicious
Similar samples:
06c39fdd95aed534806896a460c1cd568259e7b786b20abd7e923c4d1d4d8511
Tinba
2b7498abb82bfc105fb641bc1b9e9da602bfeefb252dd8d16d7c1e4fbc3a4668
Tinba
2ea5a4fb25528051254f255dc64913ca7d4faa1ecba2f40a55b536f871624fb9
Tinba
67aa5b86db90b286266d57324824825453a9db72b15414ee064dbf01085d00b4
Tinba
782f821689d70d89096d4cb5da89ce0ceb35393da77896610d5c2d4edd7414a5
Tinba
7ab96517f6852c124c82edf441496b2f005b11a4d1feb92f9cbfa2a2bffd1acb
Tinba
814cf0cf90c5b99f4bf827ca64e5c7c55d73e036b9e8646f0d6031444a90fe63
Tinba
818a7b0f2761340c423a9feabe5aae7fbf96129316ae4b0a11357cbaed344bbf
Tinba
a3c9b063a2e0b2543b34146f01d970f5ea721fac3fccc95bf1afdac5a56164e9
Tinba
ee258df3b6f2dce2898606ef5767b8a5127f50df389ca83559adf529dacdfe62
Tinba
+ 337 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-q3b2dp6s6j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_tinba_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_tinba_g1
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_tinba_w0
Create hunting rule
Author:n3sfox <n3sfox@gmail.com>
Description:Tinba 2 (DGA) banking trojan
Reference:https://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments