tinba | 82194a70d3e43b2ddbc73ac6c5393411b8e6516d3362b33a50a31618a923f974 | Triage

Sharing

General

Target

JaffaCakes118_153d7b0ca073488c5a512f84266328cd
Size

88KB
Sample

241231-mnbfqawnhx
MD5

153d7b0ca073488c5a512f84266328cd
SHA1

9e543914100bac6dd192abb196c0aeb421eff342
SHA256

82194a70d3e43b2ddbc73ac6c5393411b8e6516d3362b33a50a31618a923f974
SHA512

4c46411d7b3fcf12f491674475d0181120d8ee4023bc0d9f7c729831e9b6d82574e8e5491b34ba547ff99f6d7a80c32eab4701b0368941f0be24ae7e3fd382bc
SSDEEP

1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:25fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_153d7b0ca073488c5a512f84266328cd
- Size
  
  88KB
- MD5
  
  153d7b0ca073488c5a512f84266328cd
- SHA1
  
  9e543914100bac6dd192abb196c0aeb421eff342
- SHA256
  
  82194a70d3e43b2ddbc73ac6c5393411b8e6516d3362b33a50a31618a923f974
- SHA512
  
  4c46411d7b3fcf12f491674475d0181120d8ee4023bc0d9f7c729831e9b6d82574e8e5491b34ba547ff99f6d7a80c32eab4701b0368941f0be24ae7e3fd382bc
- SSDEEP
  
  1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:25fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan