MALICIOUS — 260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b

MALICIOUS — 260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Tnega family. 5 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b
• SHA-1: ff871c6878492e805fafe105ac9c221c69cd0f85
• MD5: 1ec914ef8443a1fb259c79b038e64ebf
• imphash: 99081afbc6b5b53b4928b1b92576607c
• ssdeep: 12288:7S+Z3onlSdOqAWIIevokBmiQPX1wCDZfDh3g0dDz850zu0QXzNokon2:+eTxAWII8oZPJZf9g0l850zVcNBK
• TLSH: T12B521A2149077193E1FFC854B8B0589C882EB4BDDCBA998C5203D86ED4C9EBBD4E18D5
• Submitted as: 260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b
• File type: pe · Size: 926208 bytes
• Verdict: malicious (91/100) · Family: Tnega

Detections (5 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Trojan:Win64/Tnega!MSR
• Emsisoft (Emergency Kit): Gen:Variant.Bulz.238468

MITRE ATT&CK

• T1071.001
• T1486

Why this verdict

The malicious score of 91/100 is the fusion of 8 weighted signals:

• Microsoft Defender flagged Trojan:Win64/Tnega!MSR (rule Trojan:Win64/Tnega!MSR) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.238468 (rule Gen:Variant.Bulz.238468) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://curl.haxx.se/docs/http-cookies.html, http://worldtimeapi.org/api/timezone/Asia/Shanghai, 1.101.3.4 - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• none

Dropped files

• 7b1c7dbe364553d87a0ef11d2f2d6f0e5e7dd658585c2fe600937ad18a87e85e - 7b1c7dbe364553d87a0ef11d2f2d6f0e5e7dd658585c2fe600937ad18a87e85e

Embedded URLs

• https://curl.haxx.se/docs/http-cookies.html
• http://worldtimeapi.org/api/timezone/Asia/Shanghai

Embedded domains

• curl.haxx.se
• example.com
• worldtimeapi.org

Embedded IP addresses

• 1.101.3.4

More Tnega samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report