tinba | 0b9129edd9d0a89d3a512d1f70b4ff3f21d3b19053d903335d964f7a59e648c2 | Triage

Sharing

General

Target

JaffaCakes118_248bf659be944089f7e60af2bea84f2d
Size

88KB
Sample

241231-sqtb7swnew
MD5

248bf659be944089f7e60af2bea84f2d
SHA1

f2d1b7c1e7762d1681ad180778f534c6bf0d8264
SHA256

0b9129edd9d0a89d3a512d1f70b4ff3f21d3b19053d903335d964f7a59e648c2
SHA512

f49c4c8457643b79b9b32bdb7aacf26db92d57def6750a5ec67b1d3b0573fa2bceb20c18fa51ca2efcf7c8e85ec885039b088ae7a1fb141563721e956885dd0b
SSDEEP

1536:g5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:g5fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_248bf659be944089f7e60af2bea84f2d
- Size
  
  88KB
- MD5
  
  248bf659be944089f7e60af2bea84f2d
- SHA1
  
  f2d1b7c1e7762d1681ad180778f534c6bf0d8264
- SHA256
  
  0b9129edd9d0a89d3a512d1f70b4ff3f21d3b19053d903335d964f7a59e648c2
- SHA512
  
  f49c4c8457643b79b9b32bdb7aacf26db92d57def6750a5ec67b1d3b0573fa2bceb20c18fa51ca2efcf7c8e85ec885039b088ae7a1fb141563721e956885dd0b
- SSDEEP
  
  1536:g5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:g5fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan