tinba | 79881ab37c38e47907f0d0d802c4cf752ae2922464459cc215b308ddccf4bc80 | Triage

Sharing

General

Target

b3d41d51773b6d8bd1c087dbd4bbd2df_JaffaCakes118
Size

96KB
Sample

240821-rsy5sstcnf
MD5

b3d41d51773b6d8bd1c087dbd4bbd2df
SHA1

7c3bd5f56ab707c2b673e2dfa7f5bfbf661e8fdb
SHA256

79881ab37c38e47907f0d0d802c4cf752ae2922464459cc215b308ddccf4bc80
SHA512

da18e175eee62c57cacf0c0f31ed2f5e8fd5896e5002378c696f6eb1df0f377117e4d7a71e49098de259028729921f7a43ecfce14aad37c864a9aa4b08a7f50b
SSDEEP

1536:HiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:HiyvRmQKTLs/ZrwWJjAqGct

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  b3d41d51773b6d8bd1c087dbd4bbd2df_JaffaCakes118
- Size
  
  96KB
- MD5
  
  b3d41d51773b6d8bd1c087dbd4bbd2df
- SHA1
  
  7c3bd5f56ab707c2b673e2dfa7f5bfbf661e8fdb
- SHA256
  
  79881ab37c38e47907f0d0d802c4cf752ae2922464459cc215b308ddccf4bc80
- SHA512
  
  da18e175eee62c57cacf0c0f31ed2f5e8fd5896e5002378c696f6eb1df0f377117e4d7a71e49098de259028729921f7a43ecfce14aad37c864a9aa4b08a7f50b
- SSDEEP
  
  1536:HiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:HiyvRmQKTLs/ZrwWJjAqGct
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan