tinba | 08e54adadf284d5a1cd2119284d582e714a3c7da217fe2c82288c50b15ba702f | Triage

Sharing

General

Target

JaffaCakes118_cf15979f061c894cee007549b7c00e9a
Size

88KB
Sample

250109-w35gsayral
MD5

cf15979f061c894cee007549b7c00e9a
SHA1

aa279165a40651fd552c10f442a225dfdebefa21
SHA256

08e54adadf284d5a1cd2119284d582e714a3c7da217fe2c82288c50b15ba702f
SHA512

b589685c376176186318f62f2f1dc8a4e79be81ae5179bc9339990830621ea88c828f487739df727e113db3d59e780ee233f7a33842e925a42c01f55ff5ccc61
SSDEEP

1536:b5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:b5fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_cf15979f061c894cee007549b7c00e9a
- Size
  
  88KB
- MD5
  
  cf15979f061c894cee007549b7c00e9a
- SHA1
  
  aa279165a40651fd552c10f442a225dfdebefa21
- SHA256
  
  08e54adadf284d5a1cd2119284d582e714a3c7da217fe2c82288c50b15ba702f
- SHA512
  
  b589685c376176186318f62f2f1dc8a4e79be81ae5179bc9339990830621ea88c828f487739df727e113db3d59e780ee233f7a33842e925a42c01f55ff5ccc61
- SSDEEP
  
  1536:b5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:b5fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan