tinba | f6fe78c6e454bad127cd75fe8f7455f6d2f93b8d821b4c749b4d4c94d1b4178d | Triage

Sharing

General

Target

JaffaCakes118_0e12340c62461d63d40b7a2a458587c1
Size

88KB
Sample

241231-kc1v5atren
MD5

0e12340c62461d63d40b7a2a458587c1
SHA1

3a3e5d3657990a9199d825be31ab2f6c7ca7cbfc
SHA256

f6fe78c6e454bad127cd75fe8f7455f6d2f93b8d821b4c749b4d4c94d1b4178d
SHA512

b0d258aba59143b245454fb36acb8e5d58f086467a51bdf2e11e32dfede4d5f64b58927dfe107aaa2a4469de8feecc2e2068bedcc1c6d9dd6ec6485523df5289
SSDEEP

1536:f5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:f5fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_0e12340c62461d63d40b7a2a458587c1
- Size
  
  88KB
- MD5
  
  0e12340c62461d63d40b7a2a458587c1
- SHA1
  
  3a3e5d3657990a9199d825be31ab2f6c7ca7cbfc
- SHA256
  
  f6fe78c6e454bad127cd75fe8f7455f6d2f93b8d821b4c749b4d4c94d1b4178d
- SHA512
  
  b0d258aba59143b245454fb36acb8e5d58f086467a51bdf2e11e32dfede4d5f64b58927dfe107aaa2a4469de8feecc2e2068bedcc1c6d9dd6ec6485523df5289
- SSDEEP
  
  1536:f5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:f5fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan