tinba | d7c0e2e8596cbbb5d5b93690ee0a20e8e2f3d89398eed6bcfd54507327bd58b8 | Triage

Sharing

General

Target

JaffaCakes118_21df4e38b2a367273b1bb8907aa9bb3d
Size

592KB
Sample

241231-rvt9mavkaw
MD5

21df4e38b2a367273b1bb8907aa9bb3d
SHA1

073399a1b96d9f9d4d24cb7f4c3b31be2d772ae1
SHA256

d7c0e2e8596cbbb5d5b93690ee0a20e8e2f3d89398eed6bcfd54507327bd58b8
SHA512

9d3a75c579779b410dad31b86c8bdd7d635f0aad6f88b395b121fc235da2b7275c4de2f437d5b64a513593871329109335e74275963e6d2d38e5083539664514
SSDEEP

6144:HCE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr6:p6TOUMBQf0ljW2vj7OyzoRaA+e

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_21df4e38b2a367273b1bb8907aa9bb3d
- Size
  
  592KB
- MD5
  
  21df4e38b2a367273b1bb8907aa9bb3d
- SHA1
  
  073399a1b96d9f9d4d24cb7f4c3b31be2d772ae1
- SHA256
  
  d7c0e2e8596cbbb5d5b93690ee0a20e8e2f3d89398eed6bcfd54507327bd58b8
- SHA512
  
  9d3a75c579779b410dad31b86c8bdd7d635f0aad6f88b395b121fc235da2b7275c4de2f437d5b64a513593871329109335e74275963e6d2d38e5083539664514
- SSDEEP
  
  6144:HCE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr6:p6TOUMBQf0ljW2vj7OyzoRaA+e
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2