tinba | 9e1d095497174e0cdd66d254711696c0c38634784e992ec72fdd41822de033f0 | Triage

Sharing

General

Target

5a64f7f9c2b84fdc991038fd5603bcaf_JaffaCakes118
Size

49KB
Sample

241019-cwl73s1glg
MD5

5a64f7f9c2b84fdc991038fd5603bcaf
SHA1

f62518cdca71ec6483fed9f287419ad913c304d5
SHA256

9e1d095497174e0cdd66d254711696c0c38634784e992ec72fdd41822de033f0
SHA512

41704358fcda928ea7fd0ab0d083aeaa5fc14c26c9d3113a2a22ebb22696ccb91931cdf047b6afe76ea3322a62a098738168fc2a04a51f900c26c001860b99cc
SSDEEP

768:NCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:1bw/6plBTFBYNNR9Jw

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  5a64f7f9c2b84fdc991038fd5603bcaf_JaffaCakes118
- Size
  
  49KB
- MD5
  
  5a64f7f9c2b84fdc991038fd5603bcaf
- SHA1
  
  f62518cdca71ec6483fed9f287419ad913c304d5
- SHA256
  
  9e1d095497174e0cdd66d254711696c0c38634784e992ec72fdd41822de033f0
- SHA512
  
  41704358fcda928ea7fd0ab0d083aeaa5fc14c26c9d3113a2a22ebb22696ccb91931cdf047b6afe76ea3322a62a098738168fc2a04a51f900c26c001860b99cc
- SSDEEP
  
  768:NCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:1bw/6plBTFBYNNR9Jw
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan