MALICIOUS — 624_Trojan.Regin.bin

MALICIOUS — 624_Trojan.Regin.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Regin family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: e1ba03a10a40aab909b2ba58dcdfd378b4d264f1f4a554b669797bbb8c8ac902
• SHA-1: 0a151553ef4c7d22ffb94a1fbc01f5b4f1900964
• MD5: 6662c390b2bbbd291ec7987388fc75d7
• imphash: 3f243f8268f79d4c3bb161fd3cd38b5c
• ssdeep: 192:PzK6RmN7Iur+27CJj5Va7OQc/9HdPvlwH9CNexyFDM5rTG9CiMsw57trH:L+Vg1VayV/9HVvlwH0NeQDM1TOrq
• TLSH: T11D245DA5D18AD399E7A2DAF46D51CDED3076809570FE1EDC2082C14EB5D484B81D335C
• Submitted as: 624_Trojan.Regin.bin
• File type: pe · Size: 12320 bytes
• Verdict: malicious (100/100) · Family: Regin

Detections (5 of 52 engines)

• ClamAV (daily): {MD5}bin.trojan.regin.9240.UNOFFICIAL
• Cyble Vision: Cyble Vision: Regin
• Microsoft Defender: Trojan:WinNT/Regin.A!dha
• Emsisoft (Emergency Kit): Backdoor.Regin.A
• Kaspersky (KVRT): Rootkit.Win32.Regin.a

Why this verdict

The malicious score of 100/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.regin.9240.UNOFFICIAL (rule {MD5}bin.trojan.regin.9240.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: Regin (rule Cyble Vision: Regin) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:WinNT/Regin.A!dha (rule Trojan:WinNT/Regin.A!dha) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Backdoor.Regin.A (rule Backdoor.Regin.A) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Rootkit.Win32.Regin.a (rule Rootkit.Win32.Regin.a) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Regin samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report