tinba | 8a3c975f041bcec99b0495f9e67366b68baac6d0c5deb11dd11a77270892befe | Triage

Sharing

General

Target

JaffaCakes118_b7620b6adf5f0bd58d84f7cde0e3dcfb
Size

88KB
Sample

250105-xdcwxavkhq
MD5

b7620b6adf5f0bd58d84f7cde0e3dcfb
SHA1

a20820d463caece8930917c193d2c344049740d3
SHA256

8a3c975f041bcec99b0495f9e67366b68baac6d0c5deb11dd11a77270892befe
SHA512

f40511b157528f234cea14bea4b9357ec913ebde8fe2245c6a6e646433d1cc5581d3f5178f3c3b2c569dcf38d0a1a415dbd7abfe3d60f033ea74ebba25dc12e9
SSDEEP

1536:v5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:v5fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_b7620b6adf5f0bd58d84f7cde0e3dcfb
- Size
  
  88KB
- MD5
  
  b7620b6adf5f0bd58d84f7cde0e3dcfb
- SHA1
  
  a20820d463caece8930917c193d2c344049740d3
- SHA256
  
  8a3c975f041bcec99b0495f9e67366b68baac6d0c5deb11dd11a77270892befe
- SHA512
  
  f40511b157528f234cea14bea4b9357ec913ebde8fe2245c6a6e646433d1cc5581d3f5178f3c3b2c569dcf38d0a1a415dbd7abfe3d60f033ea74ebba25dc12e9
- SSDEEP
  
  1536:v5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:v5fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan