tinba | 7471eac326de9ce08f8f320b008f82e52e4dac2267ebd90620f96fdd83110972 | Triage

Sharing

General

Target

331abe085de7f353800ce53135e81c36_JaffaCakes118
Size

76KB
Sample

241011-d47dnatbmc
MD5

331abe085de7f353800ce53135e81c36
SHA1

1ee819a3fb9f85b5eec71df75b91cef840d2aa4e
SHA256

7471eac326de9ce08f8f320b008f82e52e4dac2267ebd90620f96fdd83110972
SHA512

ae72e522f1ce0ce8c4fe2808c7eec934ab9c219a1e7dd931879c84f2cf20e876f519f823f50653368403ca91c7b4ec90f08a833b7971638c2a67bc3c6e160c26
SSDEEP

768:+HAl7xH0U2VFb8OaYS0a6L+nznGOevsCWg9nrC3Xybi9HW+C5c9JT:Rl7ln2HLPL+znGOe0CWgleHosHGm9JT

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  331abe085de7f353800ce53135e81c36_JaffaCakes118
- Size
  
  76KB
- MD5
  
  331abe085de7f353800ce53135e81c36
- SHA1
  
  1ee819a3fb9f85b5eec71df75b91cef840d2aa4e
- SHA256
  
  7471eac326de9ce08f8f320b008f82e52e4dac2267ebd90620f96fdd83110972
- SHA512
  
  ae72e522f1ce0ce8c4fe2808c7eec934ab9c219a1e7dd931879c84f2cf20e876f519f823f50653368403ca91c7b4ec90f08a833b7971638c2a67bc3c6e160c26
- SSDEEP
  
  768:+HAl7xH0U2VFb8OaYS0a6L+nznGOevsCWg9nrC3Xybi9HW+C5c9JT:Rl7ln2HLPL+znGOe0CWgleHosHGm9JT
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan