MALICIOUS — 643_Trojan.Sinowal.bin
MALICIOUS — 643_Trojan.Sinowal.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Sinowal family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
70484a2a2ba530d910ca3f3919b2e128579eda1c4f55248d865412d85ddf15cf - SHA-1:
464a17b62b3b89d1a5b2f2cb5e6c7589c25a8a90 - MD5:
0f82964cf39056402ee2de9193635b34 - imphash:
8116f49d45d2fd55c990c058161bad0c - ssdeep:
3072:0jzq6CUaUOq3qtNXsn5iP842ZF5pEnTlPMf7F+jIDCn9ioxXAMCQ8k:A+UOkqXhSZFDeKf5XDPoxQM - TLSH:
T14E44AE99FEDE2206F0ECD948D1041CBEC297046DAA1E1F8D5F8B964C17409E3CA69CD6 - Submitted as: 643_Trojan.Sinowal.bin
- File type: pe · Size: 242688 bytes
- Verdict: malicious (99/100) · Family: Sinowal
Detections (4 of 52 engines)
- ClamAV (daily): {MD5}bin.trojan.sinowal.9278.UNOFFICIAL
- Microsoft Defender: PWS:Win32/Sinowal.gen!AD
- Emsisoft (Emergency Kit): Gen:Variant.Mikey.184856
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.sinowal.9278.UNOFFICIAL (rule
{MD5}bin.trojan.sinowal.9278.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged PWS:Win32/Sinowal.gen!AD (rule
PWS:Win32/Sinowal.gen!AD) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Mikey.184856 (rule
Gen:Variant.Mikey.184856) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule
HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (windows)
11321 behavior events · 2 ATT&CK techniques · 12 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- inference.location.live.net
- annotatinggramma.info
- desktop-hsgcbep
- v10.events.data.microsoft.com
- config.edge.skype.com
- login.live.com
- www.bing.com
- fd.api.iris.microsoft.com
- windows.msn.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- msedge.api.cdp.microsoft.com
- sdx.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- dns.msftncsi.com
- assets.msn.com
- ecs.office.com
Dropped files
- /opt/CAPEv2/storage/analyses/6112/files/8c6c49158c13cd9f57b768ee71c765b649658cbc15357cdfa5e2ab10f47d38d8 -
8c6c49158c13cd9f57b768ee71c765b649658cbc15357cdfa5e2ab10f47d38d8 - /opt/CAPEv2/storage/analyses/6112/files/2c5e76d8ce0241394fdd0221a3da342a161fc15c891a51b6288bb8414bab1fc2 -
2c5e76d8ce0241394fdd0221a3da342a161fc15c891a51b6288bb8414bab1fc2 - /opt/CAPEv2/storage/analyses/6112/files/090cbc97999eb1cb7f01f15832328d08409420a0a75ed4e1383d04a64f1b9f88 -
090cbc97999eb1cb7f01f15832328d08409420a0a75ed4e1383d04a64f1b9f88 - cac047ebae938cd32ed73d93a5bbca9c19d2e90e5dd3eb29481487123b204f73 -
cac047ebae938cd32ed73d93a5bbca9c19d2e90e5dd3eb29481487123b204f73 - 76861ef00a4bccbd7d374e9fa9a7cc6917d9504ddb32b5fd97a7866742310ed4 -
76861ef00a4bccbd7d374e9fa9a7cc6917d9504ddb32b5fd97a7866742310ed4 - 53fb423f053610033a573e61fc4fb78ee43829a95506708bdda02c7f031d5ecd -
53fb423f053610033a573e61fc4fb78ee43829a95506708bdda02c7f031d5ecd - cbefb7df1306a8c967a5ac67b0d728087684e655bdab1a26e4d61a883fcfde21 -
cbefb7df1306a8c967a5ac67b0d728087684e655bdab1a26e4d61a883fcfde21 - 4816e06d0928b83db3bf3732f9ea53ab171f91823e1a5c99b6dd0118f36a102f -
4816e06d0928b83db3bf3732f9ea53ab171f91823e1a5c99b6dd0118f36a102f - 1afb64d5396acb90bd04c8939786fe68b74800bd34e80f9aee11e01cf9a3fcd7 -
1afb64d5396acb90bd04c8939786fe68b74800bd34e80f9aee11e01cf9a3fcd7 - 78b051736c710cfb84011c571d2bbfe921216c8036f6fa9eddd1912ebdc04480 -
78b051736c710cfb84011c571d2bbfe921216c8036f6fa9eddd1912ebdc04480 - 9dc71546aae1608d37f44ea937e0f807aaacfd79891dd8c30dd811e9364cb100 -
9dc71546aae1608d37f44ea937e0f807aaacfd79891dd8c30dd811e9364cb100 - c615bfd79a5971d3dde616906f60fdf798bdb111d5e2e16ba409678b9c3c9413 -
c615bfd79a5971d3dde616906f60fdf798bdb111d5e2e16ba409678b9c3c9413
Embedded domains
- inference.location.live.net
- annotatinggramma.info
- aefd.nelreports.net
Embedded IP addresses
- 162.159.36.2
- 108.59.6.39
File paths
- C:\TEST\bar.txt
More Sinowal samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report