tinba | 29a55c552259024a357b2ab68d7bbb72c99ea93f648fe0960459420193148815 | Triage

Sharing

General

Target

JaffaCakes118_a2ee379717bc28a26adf762edeea731d
Size

148KB
Sample

250105-pa5thstmcx
MD5

a2ee379717bc28a26adf762edeea731d
SHA1

f2cfdad6d26c35439376b8ec2e7f1a1c4ca007a2
SHA256

29a55c552259024a357b2ab68d7bbb72c99ea93f648fe0960459420193148815
SHA512

048565a411403c2b7fe8e5f630b83fc525369854f166a00a835a44074a0f180d05045388aa64e174397bb65241e9d5dcdf80cd4c841a90d49f326e8cc86d4a92
SSDEEP

1536:uv+pJdyvHh9Yvu356AlGC/kpNfDnfn8bbxvVOu3MwJMaKtqj78gE8v27O:t/dwh9uu39N81SbxthE8vCO

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_a2ee379717bc28a26adf762edeea731d
- Size
  
  148KB
- MD5
  
  a2ee379717bc28a26adf762edeea731d
- SHA1
  
  f2cfdad6d26c35439376b8ec2e7f1a1c4ca007a2
- SHA256
  
  29a55c552259024a357b2ab68d7bbb72c99ea93f648fe0960459420193148815
- SHA512
  
  048565a411403c2b7fe8e5f630b83fc525369854f166a00a835a44074a0f180d05045388aa64e174397bb65241e9d5dcdf80cd4c841a90d49f326e8cc86d4a92
- SSDEEP
  
  1536:uv+pJdyvHh9Yvu356AlGC/kpNfDnfn8bbxvVOu3MwJMaKtqj78gE8v27O:t/dwh9uu39N81SbxthE8vCO
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2