tinba | 07a0fff0a8f9f97841f5a98517907ba5e2e9d0fc74686253e62717aba01d022a | Triage

Sharing

General

Target

JaffaCakes118_64d535366f2696032c6607d568f940f6
Size

88KB
Sample

250102-nvxg7szqez
MD5

64d535366f2696032c6607d568f940f6
SHA1

33169aa06b3d51b79137327dd5d4fac035f402f6
SHA256

07a0fff0a8f9f97841f5a98517907ba5e2e9d0fc74686253e62717aba01d022a
SHA512

bd99276a2de588df112d60d2291612000481147e1342026311ca95e0e9610bcdcf4d2489ff9b61863a11ae92780df245ab8939a799d3a356a4e22137eafbf446
SSDEEP

1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:25fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_64d535366f2696032c6607d568f940f6
- Size
  
  88KB
- MD5
  
  64d535366f2696032c6607d568f940f6
- SHA1
  
  33169aa06b3d51b79137327dd5d4fac035f402f6
- SHA256
  
  07a0fff0a8f9f97841f5a98517907ba5e2e9d0fc74686253e62717aba01d022a
- SHA512
  
  bd99276a2de588df112d60d2291612000481147e1342026311ca95e0e9610bcdcf4d2489ff9b61863a11ae92780df245ab8939a799d3a356a4e22137eafbf446
- SSDEEP
  
  1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:25fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan