tinba | 04217896a12cf9b3d6532adb25da13bc217b9df8a0a75ed075b2c92ab8dfe129 | Triage

Sharing

General

Target

JaffaCakes118_cecc78ed347139f523e7cbf43fb89bdc
Size

148KB
Sample

250109-wtlcjswrbv
MD5

cecc78ed347139f523e7cbf43fb89bdc
SHA1

a5a49618670fe45ff626ecf39b5cb52f9e965615
SHA256

04217896a12cf9b3d6532adb25da13bc217b9df8a0a75ed075b2c92ab8dfe129
SHA512

680140bf7fa09054ef4c8bdb55fbbdbbcf28b7374e12826420674a4661b77d3c66623ccdc0a85efb70c0a1042047cbad7df3582f104246b2a2d579263fbcb2e7
SSDEEP

1536:Cv+pJdyvHh9Yvu356AlGC/kpNfDnfn8bbxvVOu3MwJMaKtqj78gE8v27O:J/dwh9uu39N81SbxthE8vCO

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_cecc78ed347139f523e7cbf43fb89bdc
- Size
  
  148KB
- MD5
  
  cecc78ed347139f523e7cbf43fb89bdc
- SHA1
  
  a5a49618670fe45ff626ecf39b5cb52f9e965615
- SHA256
  
  04217896a12cf9b3d6532adb25da13bc217b9df8a0a75ed075b2c92ab8dfe129
- SHA512
  
  680140bf7fa09054ef4c8bdb55fbbdbbcf28b7374e12826420674a4661b77d3c66623ccdc0a85efb70c0a1042047cbad7df3582f104246b2a2d579263fbcb2e7
- SSDEEP
  
  1536:Cv+pJdyvHh9Yvu356AlGC/kpNfDnfn8bbxvVOu3MwJMaKtqj78gE8v27O:J/dwh9uu39N81SbxthE8vCO
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2