MALICIOUS — 306460934c99fc2ec10d3d36f5d65a627b86f71ef9b7695a3b87f9039535250b

MALICIOUS — 306460934c99fc2ec10d3d36f5d65a627b86f71ef9b7695a3b87f9039535250b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Tinba family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 306460934c99fc2ec10d3d36f5d65a627b86f71ef9b7695a3b87f9039535250b
SHA-1: 587ae71c7170aaba26b2f2c34615173c0ab9db28
MD5: 544ff603905d596f5d65c6f5d24cbbdd
imphash: 303c1853d8b725edb72154f63d99b2d9
ssdeep: 1536:PEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:8Y+4MiIkLZJNAQ9J6v
TLSH: T1D83F2999522F1B85D935CA75A4082EFC8437B0F674FC7A4D0C87552B0B890A3EE760AD
Submitted as: 306460934c99fc2ec10d3d36f5d65a627b86f71ef9b7695a3b87f9039535250b
File type: pe · Size: 163840 bytes
Verdict: malicious (100/100) · Family: Tinba

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Packed.Tinba-6973140-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Tinba.AMMC!MTB
Emsisoft (Emergency Kit): Gen:Variant.Fugrafa.3491
Trellix Stinger (McAfee): Trojan-FTRG!544FF603905D
Kaspersky (KVRT): HEUR:Trojan.Win32.Tinba.pef

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Packed.Tinba-6973140-0 (rule Win.Packed.Tinba-6973140-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tinba.AMMC!MTB (rule Trojan:Win32/Tinba.AMMC!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Fugrafa.3491 (rule Gen:Variant.Fugrafa.3491) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FTRG!544FF603905D (rule Trojan-FTRG!544FF603905D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Tinba.pef (rule HEUR:Trojan.Win32.Tinba.pef) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 22 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

52349 behavior events · 3 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\E15FCC87\bin.exe - 45cb516f0cab0dcb4b2362e4b01f79e16c7a361a70d6d03db9f975ddc44610c9
10f1a8369dc88521bb6e5f884d587f43a310e8ed4249827ead4333e85c8a1a15 - 10f1a8369dc88521bb6e5f884d587f43a310e8ed4249827ead4333e85c8a1a15
bfd739790c4dd8e4d8fe93e6ebef3e1c5bfddda656d50aa18d7953f5bdb75bd9 - bfd739790c4dd8e4d8fe93e6ebef3e1c5bfddda656d50aa18d7953f5bdb75bd9
87f307098c4dd7737984a3f1b296bd358c8ce8e13da86203df32ab8b1a092a7b - 87f307098c4dd7737984a3f1b296bd358c8ce8e13da86203df32ab8b1a092a7b
64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336 - 64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336
5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 - 5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515
25c2159a5911325afc7ce4a5397356c2a47a601dc00c91c172938ae437d20b58 - 25c2159a5911325afc7ce4a5397356c2a47a601dc00c91c172938ae437d20b58
1ca85d883c608904d97cc3b9123220ec503dc3d6b6f6397672994b1eb7267a3a - 1ca85d883c608904d97cc3b9123220ec503dc3d6b6f6397672994b1eb7267a3a
87594ac1aec6b1fa77e1e4e45694a2b55f260d7a1ddb292941985203e068e0e5 - 87594ac1aec6b1fa77e1e4e45694a2b55f260d7a1ddb292941985203e068e0e5
392a23c6b261ff88b08397505d3e1142d5bf74d2799a42fb6405e933553ad8fa - 392a23c6b261ff88b08397505d3e1142d5bf74d2799a42fb6405e933553ad8fa
6503fe7871563c42109edc213b960f2f3d866abcb8ac0d62cb426d451bb9339c - 6503fe7871563c42109edc213b960f2f3d866abcb8ac0d62cb426d451bb9339c
2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 - 2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689
916489d25dfd1f9aefeb4fce434b989a45aae95d08ab8292f2a2b03b8aac66c0 - 916489d25dfd1f9aefeb4fce434b989a45aae95d08ab8292f2a2b03b8aac66c0
2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 - 2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800
a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58 - a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://spaines.pw/EiDQjNbWEQ/
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

spaines.pw
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.110
4.230.171.124
40.84.85.40
20.247.184.142
135.232.92.97
135.233.95.144
135.234.160.244
172.178.240.162
172.178.240.161
52.110.12.21
52.110.12.45
20.209.154.161
135.233.45.222
52.110.12.16
135.233.45.221
135.234.160.246
135.233.45.223
52.148.114.188
72.154.7.111
216.218.185.162

More Tinba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report