MALICIOUS — 26644a9390ee689a823c3ca94717dc3cf8061b69101724962e6c0fc600a90b36

MALICIOUS — 26644a9390ee689a823c3ca94717dc3cf8061b69101724962e6c0fc600a90b36 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Tinba family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 26644a9390ee689a823c3ca94717dc3cf8061b69101724962e6c0fc600a90b36
SHA-1: 2d5d0b3b23f7e516becf6c8381aa0b96d47b3e94
MD5: 584684b40d3a06754b864fd0f372376e
imphash: 1f818038e9a7c00938fb82807a35fdca
ssdeep: 768:0p22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:0pYoX58z1uirL98xMWnT0OQ9J2
TLSH: T1322FF1DC22AA5790E37048B43C69646C07F299480D188E4F250A367A94776B7CBFFE13
Submitted as: 26644a9390ee689a823c3ca94717dc3cf8061b69101724962e6c0fc600a90b36
File type: pe · Size: 35332 bytes
Verdict: malicious (100/100) · Family: Tinba

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Packed.Tinba-6973140-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Tinba!pz
Emsisoft (Emergency Kit): Generic.Dacic.19514.EEE79152
Kaspersky (KVRT): HEUR:Backdoor.Win32.Androm.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Packed.Tinba-6973140-0 (rule Win.Packed.Tinba-6973140-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tinba!pz (rule Trojan:Win32/Tinba!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.19514.EEE79152 (rule Generic.Dacic.19514.EEE79152) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Androm.gen (rule HEUR:Backdoor.Win32.Androm.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 10 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

106128 behavior events · 3 ATT&CK techniques · 16 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\E15FCC87\bin.exe - 654c4a3c62fcd8c99b6437e227a2cdddcc1304af09566eb0ca8b5fd88990a91a
6d1bf2e12bff5572f1d62cde85e297e93192c8a975d3b73579c50fbbc4363a92 - 6d1bf2e12bff5572f1d62cde85e297e93192c8a975d3b73579c50fbbc4363a92
7d324290ac43858b2aafcab92a2bfbd59528c51567d9088a8f6d315a6cf46afd - 7d324290ac43858b2aafcab92a2bfbd59528c51567d9088a8f6d315a6cf46afd
64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336 - 64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336
bc5c999eba044f11a9eb8c7a13eeb5279985a90a7f9dcd5b5a890a1a62a50cbb - bc5c999eba044f11a9eb8c7a13eeb5279985a90a7f9dcd5b5a890a1a62a50cbb
5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 - 5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515
46092fccc269df9c558d14ee193cc56cc2f409353168f177d0020be4dd6332f1 - 46092fccc269df9c558d14ee193cc56cc2f409353168f177d0020be4dd6332f1
2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 - 2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689
81e78ad21a5ec3c634dbbbd257481bd4f8e8d9d1a7b301c4463fa17119ee7643 - 81e78ad21a5ec3c634dbbbd257481bd4f8e8d9d1a7b301c4463fa17119ee7643
53aafe66d8987724303cc7c54e07f9d11db06872611b0fa725ce5ea6a59b6a85 - 53aafe66d8987724303cc7c54e07f9d11db06872611b0fa725ce5ea6a59b6a85
5a086bfa23cd478f08cbdb767a6fdcce8219f6a4bfa504897b613a92096252e1 - 5a086bfa23cd478f08cbdb767a6fdcce8219f6a4bfa504897b613a92096252e1
d53438cfff8c3c512812e3dcf5e05ecf2320fb9d72c566bb0f5f0b8abcf18813 - d53438cfff8c3c512812e3dcf5e05ecf2320fb9d72c566bb0f5f0b8abcf18813
2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 - 2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800
a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58 - a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58
57d4bcc420802caf4429623dd47d13cc270f5b2eece6a210cb4f5ebbe79998e2 - 57d4bcc420802caf4429623dd47d13cc270f5b2eece6a210cb4f5ebbe79998e2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://spaines.pw/EiDQjNbWEQ/

Embedded domains

spaines.pw

Embedded IP addresses

20.42.73.27
52.123.252.224
4.230.171.124
85.210.193.152
52.230.60.54
172.64.154.167
74.178.240.51
4.207.44.67
74.178.76.128
51.11.192.48
92.223.78.30
135.233.45.223
135.233.45.221
20.184.175.15
4.150.223.102
57.150.192.97
135.233.45.222
52.110.12.3
52.123.252.241
52.148.114.188
52.123.252.213
4.247.188.233
52.123.252.195
52.123.252.197
52.123.252.218

More Tinba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report