tinba | ad591f5c882bd5f6f7137b884f4e22372534854402f208c8bf50b91a29a36efc | Triage

Sharing

General

Target

JaffaCakes118_d0106b7226d75a9a8b6cf8461b9a243e
Size

88KB
Sample

250109-xvganaxrc1
MD5

d0106b7226d75a9a8b6cf8461b9a243e
SHA1

f62e2c85630754469b94851077839f04650a507d
SHA256

ad591f5c882bd5f6f7137b884f4e22372534854402f208c8bf50b91a29a36efc
SHA512

b2c61d0ccc4e0929390c514b30848063c85fdb7c5b1e10a67f41ccf60adf31311c4d66e5bd37c838809f94db5a681e0c5d1a0c14aad15de0865141d098a5abad
SSDEEP

1536:n5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:n5fvp12UFKcD/6jwqWsN

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_d0106b7226d75a9a8b6cf8461b9a243e
- Size
  
  88KB
- MD5
  
  d0106b7226d75a9a8b6cf8461b9a243e
- SHA1
  
  f62e2c85630754469b94851077839f04650a507d
- SHA256
  
  ad591f5c882bd5f6f7137b884f4e22372534854402f208c8bf50b91a29a36efc
- SHA512
  
  b2c61d0ccc4e0929390c514b30848063c85fdb7c5b1e10a67f41ccf60adf31311c4d66e5bd37c838809f94db5a681e0c5d1a0c14aad15de0865141d098a5abad
- SSDEEP
  
  1536:n5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:n5fvp12UFKcD/6jwqWsN
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Tinba family
  tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2

tinbabankerdiscoverypersistencetrojan