MALICIOUS — 58e4c7b1cf10849700e4112f1c34da25addd8030ebe6d8a8e95fcbf4ea28a897

MALICIOUS — 58e4c7b1cf10849700e4112f1c34da25addd8030ebe6d8a8e95fcbf4ea28a897 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the TinyBanker family. 6 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 58e4c7b1cf10849700e4112f1c34da25addd8030ebe6d8a8e95fcbf4ea28a897
SHA-1: 64c4462095509abb2216134cce292ac18ab2660c
MD5: 07ae153ebe965b9ac61a43792336d8ec
imphash: d63cc0b4bfe964f58532d31b71efa4f8
ssdeep: 3072:yUs/7wIByLKasQRmngeIvm8QUuP81JL1ScC474jXsrd5YM:y97wDrbeIpu0jssp5
TLSH: T18E406DC474482D24C8AC5B89DF0580CDB0D2D49D926234F68CB7AAD89741E47FBFA49B
Submitted as: 58e4c7b1cf10849700e4112f1c34da25addd8030ebe6d8a8e95fcbf4ea28a897
File type: pe · Size: 164864 bytes
Verdict: malicious (100/100) · Family: TinyBanker

Detections (6 of 56 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Malware.TinyBanker-9939943-1
Microsoft Defender: Trojan:Win32/Tinba.BA!MTB
Emsisoft (Emergency Kit): Trojan.GenericKDZ.115638
Trellix Stinger (McAfee): Packed-EW!07AE153EBE96
Kaspersky (KVRT): HEUR:Trojan-Banker.Win32.Tinba.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.TinyBanker-9939943-1 (rule Win.Malware.TinyBanker-9939943-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tinba.BA!MTB (rule Trojan:Win32/Tinba.BA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.115638 (rule Trojan.GenericKDZ.115638) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-EW!07AE153EBE96 (rule Packed-EW!07AE153EBE96) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Banker.Win32.Tinba.gen (rule HEUR:Trojan-Banker.Win32.Tinba.gen) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

65064 behavior events · 3 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\B439FFAA\bin.exe - 699bea5ec8fd7b8f88e506ce402cd6390d192e91ca5abf1e163f34af3d5f9d9f
4aa8d029147d93fed31623cd9e1431562d15b5e833be8d47b9503815fb09bbde - 4aa8d029147d93fed31623cd9e1431562d15b5e833be8d47b9503815fb09bbde
137d1190bc9ad2dc38e95a19b8c8b8d19d488351885f1124fd5c6ba35ba76b55 - 137d1190bc9ad2dc38e95a19b8c8b8d19d488351885f1124fd5c6ba35ba76b55
f57527c961f4edfb1d63b07b99b5d0ed5a791bccb7276825466b2c7220799b42 - f57527c961f4edfb1d63b07b99b5d0ed5a791bccb7276825466b2c7220799b42
37f648abba4a0d30cff08e4e7b94b49ca0c15379e134a733c5ebde18c6e64e1a - 37f648abba4a0d30cff08e4e7b94b49ca0c15379e134a733c5ebde18c6e64e1a
be9137c6889c5dd5630c2d1c420c971bd68ad8abb56c636c928a8684dbd4a571 - be9137c6889c5dd5630c2d1c420c971bd68ad8abb56c636c928a8684dbd4a571
65ff828479663b8a6a27af97b5d1a749c7c84a16553a25b248ce944835d9b846 - 65ff828479663b8a6a27af97b5d1a749c7c84a16553a25b248ce944835d9b846
fee3eeff84ae90130251d2cd23b18e62dabc40a93ae7acc39b03822008e5aac2 - fee3eeff84ae90130251d2cd23b18e62dabc40a93ae7acc39b03822008e5aac2
bda522e7b6fedfa0a1007c57deba8ddf726ea40a98b9283664718de82efe18af - bda522e7b6fedfa0a1007c57deba8ddf726ea40a98b9283664718de82efe18af

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://blackfreeqazyio.cc/bl0yj67sdf3hj0ack/

Embedded domains

blackfreeqazyio.cc

Embedded IP addresses

20.184.175.10
4.144.132.223
4.230.171.124
4.247.188.224
20.165.94.54
135.233.95.144
20.184.175.16
104.18.33.89
20.165.94.63
172.178.240.163
57.154.63.210
135.234.160.245
52.148.114.188
20.42.73.25
20.184.175.18
72.154.7.114
216.218.185.162
52.110.12.15
52.110.12.30

More TinyBanker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report