MALICIOUS — 34204b003e33893326bd9bb5b25735e53d310857f8044ac1d363eed82570b1c6

MALICIOUS — 34204b003e33893326bd9bb5b25735e53d310857f8044ac1d363eed82570b1c6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Tinba family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 34204b003e33893326bd9bb5b25735e53d310857f8044ac1d363eed82570b1c6
SHA-1: 3d6d22a727444a9e663d6517e6d2af52adcb6603
MD5: 093bdaba895a70c895d9106b3bd63599
imphash: ee507f88869dd75beff889765b743876
ssdeep: 1536:9r+mFM2HXKZgixhIksu+XM5/HtAQ9Jox7:R+4MJIkLZJNAQ9Jo9
TLSH: T13B3A1999422F1B85D975CA75A0042EBC8437B0F675FDBA4E0C8795270B890A3EE750BC
Submitted as: 34204b003e33893326bd9bb5b25735e53d310857f8044ac1d363eed82570b1c6
File type: pe · Size: 93184 bytes
Verdict: malicious (100/100) · Family: Tinba

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Packed.Tinba-6973140-0
Microsoft Defender: Trojan:Win32/Tinba!pz
Emsisoft (Emergency Kit): Gen:Variant.Fugrafa.3491
Kaspersky (KVRT): HEUR:Trojan.Win32.Tinba.pef

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Packed.Tinba-6973140-0 (rule Win.Packed.Tinba-6973140-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tinba!pz (rule Trojan:Win32/Tinba!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Fugrafa.3491 (rule Gen:Variant.Fugrafa.3491) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Tinba.pef (rule HEUR:Trojan.Win32.Tinba.pef) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

70539 behavior events · 3 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\WebCache\V01.chk - dd8f0c707cac8db13d7834c9e23ccca7cd2e23a0d61dff7a4f6f8683a6d6ba9f
C:\Users\analyst\AppData\Roaming\E15FCC87\bin.exe - ab924b5ee5288d271bc3456e8635f8405f9fbc9e7962061f8a9c5f11846fa6cf
9b384e7ecde14540e103ea3414900ee9e5f5175dc830043d7ac88c1deb1d418e - 9b384e7ecde14540e103ea3414900ee9e5f5175dc830043d7ac88c1deb1d418e
87f307098c4dd7737984a3f1b296bd358c8ce8e13da86203df32ab8b1a092a7b - 87f307098c4dd7737984a3f1b296bd358c8ce8e13da86203df32ab8b1a092a7b
64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336 - 64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336
04e739eb0a26dd3991c3f2f23c2112ae239ec4d33d42664fb71bad08a641b662 - 04e739eb0a26dd3991c3f2f23c2112ae239ec4d33d42664fb71bad08a641b662
bfdb7857519087a181ba2fb9fc6acf69aeedc097bbe2173ab367e59980575731 - bfdb7857519087a181ba2fb9fc6acf69aeedc097bbe2173ab367e59980575731
5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 - 5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515
2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 - 2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689
c40822cbdd19b1666b84045f099b72c15803481fcd820a7f3f244574bd334584 - c40822cbdd19b1666b84045f099b72c15803481fcd820a7f3f244574bd334584
2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 - 2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800
a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58 - a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://spaines.pw/EiDQjNbWEQ/
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

spaines.pw
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.20
52.123.252.218
4.230.171.124
57.154.63.210
40.84.85.40
74.179.77.204
4.247.188.224
172.64.154.167
20.165.94.54
135.232.92.137
20.50.73.15
20.247.184.142
52.148.114.188
51.132.193.104
172.178.240.162
85.210.196.11
20.184.175.15
135.233.95.80
72.154.7.109
216.218.185.162
52.110.12.24
52.110.12.47

More Tinba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report