tinba | ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d | Triage

Sharing

General

Target

JaffaCakes118_5677387e86650ea25137cb5bce341349
Size

52KB
Sample

250101-qga36aykem
MD5

5677387e86650ea25137cb5bce341349
SHA1

bf3e5583fb2b052a3ca9d9fd53e75c6bab6942d2
SHA256

ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d
SHA512

d0e079e0eef54a32a408e47131633f3b82a3d119fe261c71749f38b1f39188e3d0965da37caa5e9850a0791a8bafdefed566a2c3cbd17c26eeb8f92cdbd9de86
SSDEEP

768:yCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9J:6bw/6plBTFBYNNR9J

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_5677387e86650ea25137cb5bce341349
- Size
  
  52KB
- MD5
  
  5677387e86650ea25137cb5bce341349
- SHA1
  
  bf3e5583fb2b052a3ca9d9fd53e75c6bab6942d2
- SHA256
  
  ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d
- SHA512
  
  d0e079e0eef54a32a408e47131633f3b82a3d119fe261c71749f38b1f39188e3d0965da37caa5e9850a0791a8bafdefed566a2c3cbd17c26eeb8f92cdbd9de86
- SSDEEP
  
  768:yCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9J:6bw/6plBTFBYNNR9J
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan