tinba | bbce669f78361e7c48fd803ffbd1512a4192637d4af52e7bd5da84d9e6d9748d | Triage

Sharing

General

Target

JaffaCakes118_b928aabbe5f72bf41b0e053bf531464a
Size

88KB
Sample

250109-cxm6rstqh1
MD5

b928aabbe5f72bf41b0e053bf531464a
SHA1

447fe4fd8532b2e643653f047ad2ca08b1153410
SHA256

bbce669f78361e7c48fd803ffbd1512a4192637d4af52e7bd5da84d9e6d9748d
SHA512

25bf6c2aab569d6e13f74d5a8574a30917af360656cf05788149f112be9734d108185544dc2dd0a6d27d2771ee827a365bb6c306aaabc759b0a7bec6e8aa523d
SSDEEP

1536:45nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:45fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_b928aabbe5f72bf41b0e053bf531464a
- Size
  
  88KB
- MD5
  
  b928aabbe5f72bf41b0e053bf531464a
- SHA1
  
  447fe4fd8532b2e643653f047ad2ca08b1153410
- SHA256
  
  bbce669f78361e7c48fd803ffbd1512a4192637d4af52e7bd5da84d9e6d9748d
- SHA512
  
  25bf6c2aab569d6e13f74d5a8574a30917af360656cf05788149f112be9734d108185544dc2dd0a6d27d2771ee827a365bb6c306aaabc759b0a7bec6e8aa523d
- SSDEEP
  
  1536:45nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:45fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan