tinba | 4690ef9e8a7a77ea30029eeb1b913bceeab75a71bf18dce34c26467fa9d4cdda | Triage

Sharing

General

Target

JaffaCakes118_242a2c3c37188e2ecf3e79798149a3df
Size

372KB
Sample

241231-slmzmaylhr
MD5

242a2c3c37188e2ecf3e79798149a3df
SHA1

0b3d5ed0fd1aca72ef55e6e664f6ffdc84e6a637
SHA256

4690ef9e8a7a77ea30029eeb1b913bceeab75a71bf18dce34c26467fa9d4cdda
SHA512

2c8dde71609b8499fbb179adce659fc008dc8948fe79cf8ef3cc2669274d5b3070a2ef8605a9018a58b67ad0976d3b8f6b4b4ed4c09891b296f4587fbdcd54c2
SSDEEP

6144:8CE6/mUXJ531nIUliViSZbLhaZfvMlLXICg:86TOUMBQf0ljW

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_242a2c3c37188e2ecf3e79798149a3df
- Size
  
  372KB
- MD5
  
  242a2c3c37188e2ecf3e79798149a3df
- SHA1
  
  0b3d5ed0fd1aca72ef55e6e664f6ffdc84e6a637
- SHA256
  
  4690ef9e8a7a77ea30029eeb1b913bceeab75a71bf18dce34c26467fa9d4cdda
- SHA512
  
  2c8dde71609b8499fbb179adce659fc008dc8948fe79cf8ef3cc2669274d5b3070a2ef8605a9018a58b67ad0976d3b8f6b4b4ed4c09891b296f4587fbdcd54c2
- SSDEEP
  
  6144:8CE6/mUXJ531nIUliViSZbLhaZfvMlLXICg:86TOUMBQf0ljW
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2