SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tinymet (Back to overview)

TinyMet

aka: TiniMet

Actor(s): Anunak, TA505


TinyMet is a meterpreter stager.

References
2020-06-17Twitter (@VK_intel)Vitali Kremez, malwrhunterteam
@online{kremez:20200617:signed:f8eecc6, author = {Vitali Kremez and malwrhunterteam}, title = {{Tweet on signed Tinymet payload (V.02) used by TA505}}, date = {2020-06-17}, organization = {Twitter (@VK_intel)}, url = {https://twitter.com/VK_Intel/status/1273292957429510150}, language = {English}, urldate = {2020-06-18} } Tweet on signed Tinymet payload (V.02) used by TA505
TinyMet
2020-03-26TelekomThomas Barabosch
@online{barabosch:20200326:ta505s:24d9805, author = {Thomas Barabosch}, title = {{TA505's Box of Chocolate - On Hidden Gems packed with the TA505 Packer}}, date = {2020-03-26}, organization = {Telekom}, url = {https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672}, language = {English}, urldate = {2020-03-27} } TA505's Box of Chocolate - On Hidden Gems packed with the TA505 Packer
Amadey Azorult Clop FlawedGrace Get2 SDBbot Silence TinyMet TA505
2020-02-28Financial Security InstituteFinancial Security Institute
@online{institute:20200228:profiling:ebaa39b, author = {Financial Security Institute}, title = {{Profiling of TA505 Threat Group That Continues to Attack the Financial Sector}}, date = {2020-02-28}, organization = {Financial Security Institute}, url = {https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do}, language = {English}, urldate = {2020-02-28} } Profiling of TA505 Threat Group That Continues to Attack the Financial Sector
Amadey Clop FlawedAmmyy Rapid Ransom SDBbot TinyMet
2020-02-13QianxinQi Anxin Threat Intelligence Center
@techreport{center:20200213:report:146d333, author = {Qi Anxin Threat Intelligence Center}, title = {{APT Report 2019}}, date = {2020-02-13}, institution = {Qianxin}, url = {https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf}, language = {English}, urldate = {2020-02-27} } APT Report 2019
Chrysaor Exodus Dacls elf.vpnfilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2020SecureworksSecureWorks
@online{secureworks:2020:gold:97e5784, author = {SecureWorks}, title = {{GOLD NIAGARA}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/gold-niagara}, language = {English}, urldate = {2020-05-23} } GOLD NIAGARA
Bateleur Griffon Carbanak Cobalt Strike DRIFTPIN TinyMet Anunak
2019-08-20Github (SherifEldeeb)Sherif Eldeeb
@online{eldeeb:20190820:source:66124bb, author = {Sherif Eldeeb}, title = {{Source code: TinyMet}}, date = {2019-08-20}, organization = {Github (SherifEldeeb)}, url = {https://github.com/SherifEldeeb/TinyMet}, language = {English}, urldate = {2020-02-13} } Source code: TinyMet
TinyMet
2019-03-20FlashpointJoshua Platt, Jason Reaves
@online{platt:20190320:fin7:bac265f, author = {Joshua Platt and Jason Reaves}, title = {{FIN7 Revisited: Inside Astra Panel and SQLRat Malware}}, date = {2019-03-20}, organization = {Flashpoint}, url = {https://www.flashpoint-intel.com/blog/fin7-revisited:-inside-astra-panel-and-sqlrat-malware/}, language = {English}, urldate = {2019-12-18} } FIN7 Revisited: Inside Astra Panel and SQLRat Malware
DNSRat TinyMet
Yara Rules
[TLP:WHITE] win_tinymet_auto (20200529 | autogenerated rule brought to you by yara-signator)
rule win_tinymet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-05-30"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinymet"
        malpedia_rule_date = "20200529"
        malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8"
        malpedia_version = "20200529"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffd3 03f8 2bf0 75e7 a1???????? }
            // n = 5, score = 100
            //   ffd3                 | call                ebx
            //   03f8                 | add                 edi, eax
            //   2bf0                 | sub                 esi, eax
            //   75e7                 | jne                 0xffffffe9
            //   a1????????           |                     

        $sequence_1 = { ff15???????? 50 e8???????? 59 8d45f0 6a04 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   6a04                 | push                4

        $sequence_2 = { 72ee 5f 5e 0fb6c3 5b }
            // n = 5, score = 100
            //   72ee                 | jb                  0xfffffff0
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   0fb6c3               | movzx               eax, bl
            //   5b                   | pop                 ebx

        $sequence_3 = { 750a 68???????? e9???????? 53 56 }
            // n = 5, score = 100
            //   750a                 | jne                 0xc
            //   68????????           |                     
            //   e9????????           |                     
            //   53                   | push                ebx
            //   56                   | push                esi

        $sequence_4 = { 7435 48 741d 48 7416 }
            // n = 5, score = 100
            //   7435                 | je                  0x37
            //   48                   | dec                 eax
            //   741d                 | je                  0x1f
            //   48                   | dec                 eax
            //   7416                 | je                  0x18

        $sequence_5 = { eb17 6a00 ebe9 6a00 ff35???????? ff35???????? e8???????? }
            // n = 7, score = 100
            //   eb17                 | jmp                 0x19
            //   6a00                 | push                0
            //   ebe9                 | jmp                 0xffffffeb
            //   6a00                 | push                0
            //   ff35????????         |                     
            //   ff35????????         |                     
            //   e8????????           |                     

        $sequence_6 = { 885de8 895de9 885ded 895dfc ff15???????? 50 }
            // n = 6, score = 100
            //   885de8               | mov                 byte ptr [ebp - 0x18], bl
            //   895de9               | mov                 dword ptr [ebp - 0x17], ebx
            //   885ded               | mov                 byte ptr [ebp - 0x13], bl
            //   895dfc               | mov                 dword ptr [ebp - 4], ebx
            //   ff15????????         |                     
            //   50                   | push                eax

        $sequence_7 = { 8bc6 5f 5e 5d c3 a1???????? 56 }
            // n = 7, score = 100
            //   8bc6                 | mov                 eax, esi
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   a1????????           |                     
            //   56                   | push                esi

    condition:
        7 of them and filesize < 57344
}
Download all Yara Rules