MALICIOUS — a8660fc1c66fd075ef9ec5ad096b21d7616f333eb466fab15c820f7f862702e1
MALICIOUS — a8660fc1c66fd075ef9ec5ad096b21d7616f333eb466fab15c820f7f862702e1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Tinba family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
a8660fc1c66fd075ef9ec5ad096b21d7616f333eb466fab15c820f7f862702e1 - SHA-1:
fa823d03c59cc6a110b7d5bb4439cef8f06b9f00 - MD5:
c6e59837cf2d6d7e8908c08944466eca - imphash:
303c1853d8b725edb72154f63d99b2d9 - ssdeep:
1536:JEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:CY+4MiIkLZJNAQ9J6v - TLSH:
T1E23F2999522F1B85D935CA75A4082EFC8437B0F674FC7A4D0C87552B0B890A3EE760AD - Submitted as: a8660fc1c66fd075ef9ec5ad096b21d7616f333eb466fab15c820f7f862702e1
- File type: pe · Size: 163840 bytes
- Verdict: malicious (100/100) · Family: Tinba
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Packed.Tinba-6973140-0
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:Win32/Tinba.AMMC!MTB
- Emsisoft (Emergency Kit): Gen:Variant.Fugrafa.3491
- Trellix Stinger (McAfee): Trojan-FTRG!C6E59837CF2D
- Kaspersky (KVRT): HEUR:Trojan.Win32.Tinba.pef
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 14 weighted signals:
- ClamAV (daily) flagged Win.Packed.Tinba-6973140-0 (rule
Win.Packed.Tinba-6973140-0) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Microsoft Defender flagged Trojan:Win32/Tinba.AMMC!MTB (rule
Trojan:Win32/Tinba.AMMC!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Fugrafa.3491 (rule
Gen:Variant.Fugrafa.3491) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Trojan-FTRG!C6E59837CF2D (rule
Trojan-FTRG!C6E59837CF2D) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Tinba.pef (rule
HEUR:Trojan.Win32.Tinba.pef) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 2 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
64007 behavior events · 2 ATT&CK techniques · 11 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- spaines.pw
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Roaming\E15FCC87\bin.exe -
c33ee008eb49682fdb0bbca31499646c5ecb9eff2f98e89c2dbabfb4ba0cdc9c - 6ae3f03907de89ec7161d5892d9e4f50c8bbeab329b27f7fd4d83fc6de49d191 -
6ae3f03907de89ec7161d5892d9e4f50c8bbeab329b27f7fd4d83fc6de49d191 - 482f6be79272ecd355fd5fb1f547e079a6507cb0718ee660d607206d85d49333 -
482f6be79272ecd355fd5fb1f547e079a6507cb0718ee660d607206d85d49333 - d7d1c997bdb027230c881aec25bcd56881a620b85ab7e0d92c1b103c8222bdf4 -
d7d1c997bdb027230c881aec25bcd56881a620b85ab7e0d92c1b103c8222bdf4 - 64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336 -
64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336 - 5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 -
5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 - 2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 -
2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 - b4f8182b27420b91c90e9189589338955b14949473f3621002c2d93fa7c89a88 -
b4f8182b27420b91c90e9189589338955b14949473f3621002c2d93fa7c89a88 - 8c28b1e156037c235824f282331be263dade5d14b7d8d2c39fa24c4cfb3bf9f0 -
8c28b1e156037c235824f282331be263dade5d14b7d8d2c39fa24c4cfb3bf9f0 - 2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 -
2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 - a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58 -
a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://spaines.pw/EiDQjNbWEQ/
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- spaines.pw
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 4.150.223.112
- 52.123.252.245
- 4.230.171.124
- 20.42.179.204
- 20.247.184.142
- 20.165.94.54
- 172.64.154.167
- 74.179.77.204
- 52.168.117.169
- 57.155.101.212
- 172.178.240.162
- 135.234.160.246
- 135.233.45.222
- 57.150.192.97
- 92.223.78.30
- 52.110.12.30
- 52.110.12.8
- 135.233.45.221
- 52.148.114.188
- 52.110.12.44
- 52.110.12.25
- 72.153.5.130
- 216.218.185.162
More Tinba samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report