tinba | 626eb28e1efa9e59d4623f5d1f1f7ab5a57e05138571cd322010a052352b5287 | Triage

Sharing

General

Target

JaffaCakes118_5e832adcb48953124ee405825368030c
Size

88KB
Sample

250107-mv271sxqe1
MD5

5e832adcb48953124ee405825368030c
SHA1

38fa41ef3c8bbe42983bfc27a017bd9e27ecc837
SHA256

626eb28e1efa9e59d4623f5d1f1f7ab5a57e05138571cd322010a052352b5287
SHA512

da4e397bd3a51bc29454678c56b42b315fcca0327bf21cdad9d8e48f0957bee86c6cf502da7ef29a54de22a0191522a219ee7b8e9079078d8b1a716205d98f41
SSDEEP

1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:25fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_5e832adcb48953124ee405825368030c
- Size
  
  88KB
- MD5
  
  5e832adcb48953124ee405825368030c
- SHA1
  
  38fa41ef3c8bbe42983bfc27a017bd9e27ecc837
- SHA256
  
  626eb28e1efa9e59d4623f5d1f1f7ab5a57e05138571cd322010a052352b5287
- SHA512
  
  da4e397bd3a51bc29454678c56b42b315fcca0327bf21cdad9d8e48f0957bee86c6cf502da7ef29a54de22a0191522a219ee7b8e9079078d8b1a716205d98f41
- SSDEEP
  
  1536:25nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:25fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan