tinba | 6b3045381513d819c92c265c847fc05d9fe591b3f0bef449a368ae17fd23f4f7 | Triage

Sharing

General

Target

JaffaCakes118_42d6043b2470828883f624b8c22e56f2
Size

96KB
Sample

250101-b843zsznbs
MD5

42d6043b2470828883f624b8c22e56f2
SHA1

26e533b7bf95c6f8a3694a1887f29a0a76754ded
SHA256

6b3045381513d819c92c265c847fc05d9fe591b3f0bef449a368ae17fd23f4f7
SHA512

d64372a92ae9f0f2e5e03ba567b52ccc61ac550d8e614c25d29893dc5797ed17cefa6ad7faefb2ccbce193562156342324c48dedaf0be836cc2936c1acaef373
SSDEEP

1536:eiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:eiyvRmQKTLs/ZrwWJjAqGct

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_42d6043b2470828883f624b8c22e56f2
- Size
  
  96KB
- MD5
  
  42d6043b2470828883f624b8c22e56f2
- SHA1
  
  26e533b7bf95c6f8a3694a1887f29a0a76754ded
- SHA256
  
  6b3045381513d819c92c265c847fc05d9fe591b3f0bef449a368ae17fd23f4f7
- SHA512
  
  d64372a92ae9f0f2e5e03ba567b52ccc61ac550d8e614c25d29893dc5797ed17cefa6ad7faefb2ccbce193562156342324c48dedaf0be836cc2936c1acaef373
- SSDEEP
  
  1536:eiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:eiyvRmQKTLs/ZrwWJjAqGct
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan