tinba | 640db2b24b1ff39f4c6c8eb1d177c7d9882d55839744901e55891a496bab7304 | Triage

Sharing

General

Target

JaffaCakes118_95ba507c62f9bfbe0bc258702450e634
Size

49KB
Sample

250105-jqsagazlgl
MD5

95ba507c62f9bfbe0bc258702450e634
SHA1

1a3af882c7600a021a7a01e5739e630ad45dc3b8
SHA256

640db2b24b1ff39f4c6c8eb1d177c7d9882d55839744901e55891a496bab7304
SHA512

f2d33ced2ca42e7d0d7922f6778b3ad8aa362418d86e6f45285d2069fce6ca8f0b52b3155f4165ebdb84d4b74764a768acd497eeb1a70dd1fa47ef5044d6c565
SSDEEP

768:LCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:vbw/6plBTFBYNNR9Jw

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_95ba507c62f9bfbe0bc258702450e634
- Size
  
  49KB
- MD5
  
  95ba507c62f9bfbe0bc258702450e634
- SHA1
  
  1a3af882c7600a021a7a01e5739e630ad45dc3b8
- SHA256
  
  640db2b24b1ff39f4c6c8eb1d177c7d9882d55839744901e55891a496bab7304
- SHA512
  
  f2d33ced2ca42e7d0d7922f6778b3ad8aa362418d86e6f45285d2069fce6ca8f0b52b3155f4165ebdb84d4b74764a768acd497eeb1a70dd1fa47ef5044d6c565
- SSDEEP
  
  768:LCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:vbw/6plBTFBYNNR9Jw
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan