tinba | 4109d7fd00e634840fd12ac78c4e03807525f314ea7193ddfd2af0e80659f5a7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ef758902c68cff2fb4f634d635bb36b_JaffaCakes118
Size

88KB
Sample

240720-en83zsvhrl
MD5

5ef758902c68cff2fb4f634d635bb36b
SHA1

70796e44db508c705bc8eb8586e9348c3d5bf000
SHA256

4109d7fd00e634840fd12ac78c4e03807525f314ea7193ddfd2af0e80659f5a7
SHA512

88119927a1f4f15335fc93ea374e104a4638beeadfe36278c9e0bc27d853cf1af7b7dbf07dbb9843bc5549144f9f67fa669a25c8d5684e5bcce672dc7b7e95c5
SSDEEP

1536:EPx+riFFG1g3K6KUm3wEeQqjh+rmKVsNsU:OYdsFE2jwqWsNsU

Score

10^/10

tinba banker persistence trojan

Malware Config

Targets

- Target
  
  5ef758902c68cff2fb4f634d635bb36b_JaffaCakes118
- Size
  
  88KB
- MD5
  
  5ef758902c68cff2fb4f634d635bb36b
- SHA1
  
  70796e44db508c705bc8eb8586e9348c3d5bf000
- SHA256
  
  4109d7fd00e634840fd12ac78c4e03807525f314ea7193ddfd2af0e80659f5a7
- SHA512
  
  88119927a1f4f15335fc93ea374e104a4638beeadfe36278c9e0bc27d853cf1af7b7dbf07dbb9843bc5549144f9f67fa669a25c8d5684e5bcce672dc7b7e95c5
- SSDEEP
  
  1536:EPx+riFFG1g3K6KUm3wEeQqjh+rmKVsNsU:OYdsFE2jwqWsNsU
Score

10^/10

tinba banker persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerpersistencetrojan

behavioral2

tinbabankerpersistencetrojan