tinba | 92a663cd07ad0bc0280d8abd84af6f80bd56c8d4382cfea8b02e1612f76bc470 | Triage

Sharing

General

Target

0b48f857bca7a647bd55bffae05924e9_JaffaCakes118
Size

59KB
Sample

241002-shjg2asfrq
MD5

0b48f857bca7a647bd55bffae05924e9
SHA1

cb8e2f72075e137f5ac71c5693bff1291f30000a
SHA256

92a663cd07ad0bc0280d8abd84af6f80bd56c8d4382cfea8b02e1612f76bc470
SHA512

a6e004f61ec1530b2b30ed29f6d23ec5118dc1fb22ed277404ea0ccf68bede6eb6503653a6914d8235f0b5530ae2fffbe87fc5fad8aa8bcf7276d6979d26fea1
SSDEEP

768:h+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9J1:h+mFM2HXKZgiFP7xIksu+XM5O9J1

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  0b48f857bca7a647bd55bffae05924e9_JaffaCakes118
- Size
  
  59KB
- MD5
  
  0b48f857bca7a647bd55bffae05924e9
- SHA1
  
  cb8e2f72075e137f5ac71c5693bff1291f30000a
- SHA256
  
  92a663cd07ad0bc0280d8abd84af6f80bd56c8d4382cfea8b02e1612f76bc470
- SHA512
  
  a6e004f61ec1530b2b30ed29f6d23ec5118dc1fb22ed277404ea0ccf68bede6eb6503653a6914d8235f0b5530ae2fffbe87fc5fad8aa8bcf7276d6979d26fea1
- SSDEEP
  
  768:h+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9J1:h+mFM2HXKZgiFP7xIksu+XM5O9J1
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan