tinba | dc3d75692e6b82b3ebd1a4e657553cbb90c41ae366912b97586143ec54658ff7 | Triage

Sharing

General

Target

JaffaCakes118_547a66dc1d8763f878fc27e5b74e9115
Size

88KB
Sample

250101-pap33awrdn
MD5

547a66dc1d8763f878fc27e5b74e9115
SHA1

0b9b4da0a2f523d3b7b54c6659b382b6225da0ce
SHA256

dc3d75692e6b82b3ebd1a4e657553cbb90c41ae366912b97586143ec54658ff7
SHA512

40196fcf38235711c82d0cf85e35a21b70f5ac4c6e02966a5f0c1a07f12a0dc5b14ae5fb5c8e53e3ad9e5a241f2fe2af4c14e891eb1ef732f880da76fed410b5
SSDEEP

1536:XPx+riFFG1g3K6KUm3wEeQqjh+rmKVsNsU:9YdsFE2jwqWsNsU

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_547a66dc1d8763f878fc27e5b74e9115
- Size
  
  88KB
- MD5
  
  547a66dc1d8763f878fc27e5b74e9115
- SHA1
  
  0b9b4da0a2f523d3b7b54c6659b382b6225da0ce
- SHA256
  
  dc3d75692e6b82b3ebd1a4e657553cbb90c41ae366912b97586143ec54658ff7
- SHA512
  
  40196fcf38235711c82d0cf85e35a21b70f5ac4c6e02966a5f0c1a07f12a0dc5b14ae5fb5c8e53e3ad9e5a241f2fe2af4c14e891eb1ef732f880da76fed410b5
- SSDEEP
  
  1536:XPx+riFFG1g3K6KUm3wEeQqjh+rmKVsNsU:9YdsFE2jwqWsNsU
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan