tinba | 097cbc795b76cedc6ddacda7e2a16fe222c527fa653d2ef332991e97809f0aa5 | Triage

Sharing

General

Target

JaffaCakes118_5f0699e877d9195692ca37a00bf87255
Size

88KB
Sample

250101-wlpp1awncw
MD5

5f0699e877d9195692ca37a00bf87255
SHA1

26b4167bff1fbbfd1b68387099fa0587089d4d8e
SHA256

097cbc795b76cedc6ddacda7e2a16fe222c527fa653d2ef332991e97809f0aa5
SHA512

fea499ca5d71bd0964a20ac0e1ae462a35bb19ee4d54e0a3a516403f56b6d75e22ed170a616b7eede1994666c1131e10c889877b7f42aa1ada4544a1ab94c326
SSDEEP

1536:45nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:45fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_5f0699e877d9195692ca37a00bf87255
- Size
  
  88KB
- MD5
  
  5f0699e877d9195692ca37a00bf87255
- SHA1
  
  26b4167bff1fbbfd1b68387099fa0587089d4d8e
- SHA256
  
  097cbc795b76cedc6ddacda7e2a16fe222c527fa653d2ef332991e97809f0aa5
- SHA512
  
  fea499ca5d71bd0964a20ac0e1ae462a35bb19ee4d54e0a3a516403f56b6d75e22ed170a616b7eede1994666c1131e10c889877b7f42aa1ada4544a1ab94c326
- SSDEEP
  
  1536:45nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:45fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan