MALICIOUS — eb85e76a588750a380a9d47a1fa5c2e1af768c029b348f797926a8262919af28

MALICIOUS — eb85e76a588750a380a9d47a1fa5c2e1af768c029b348f797926a8262919af28 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the TinyBanker family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: eb85e76a588750a380a9d47a1fa5c2e1af768c029b348f797926a8262919af28
SHA-1: bf45b6961f921acf15ee1a36860ab263eb111cfc
MD5: 7719b6fe4c1192d9044fb3d528f504ca
imphash: d0f156be95b89ada5813326f915d62a1
ssdeep: 1536:e5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:e5fvp12UFKcD/6jwqWsN
TLSH: T185394CB5863E061BC6FB2265C00D24AE742BB8FBE8D9955E9A03C01777F90D756702B0
Submitted as: eb85e76a588750a380a9d47a1fa5c2e1af768c029b348f797926a8262919af28
File type: pe · Size: 90112 bytes
Verdict: malicious (100/100) · Family: TinyBanker

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.u
ClamAV (daily): Win.Dropper.TinyBanker-9852021-1
Microsoft Defender: Trojan:Win32/Dofoil!pz
Trellix Stinger (McAfee): Packed-FE!7719B6FE4C11
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Dropper.TinyBanker-9852021-1 (rule Win.Dropper.TinyBanker-9852021-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Dofoil!pz (rule Trojan:Win32/Dofoil!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-FE!7719B6FE4C11 (rule Packed-FE!7719B6FE4C11) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 8 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.u (rule high-entropy-sections:.u) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.u - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

66015 behavior events · 3 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\WebCache\V01.chk - f6ec38909ba7a85f1808974c72ae61802fe3d27ff26564b3072576020a534e67
C:\Users\analyst\AppData\Roaming\E15FCC87\bin.exe - 20eda90ec116b2b01b9e50cc95793c488aac839adbc657d3168ee5c5478f3bba
d105041bfb76c0ba3091f22dfa41ef48a2c3fdee06e9ead29fd2a7f49b1d3f7f - d105041bfb76c0ba3091f22dfa41ef48a2c3fdee06e9ead29fd2a7f49b1d3f7f
5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 - 5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515
b04a797b5eaa8f9a60044914a9807803a21b6ccf9a85264abd1561e53895c2d7 - b04a797b5eaa8f9a60044914a9807803a21b6ccf9a85264abd1561e53895c2d7
2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 - 2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689
f0fa8bee65da6b1d2d68116fd18a83dc596944b1209918e0bb74d5d259262f40 - f0fa8bee65da6b1d2d68116fd18a83dc596944b1209918e0bb74d5d259262f40
41cb6af9e4e2eff4f9bd3dd1f2c742b60870e3c5eb0c6f75e2f41778720e8b3a - 41cb6af9e4e2eff4f9bd3dd1f2c742b60870e3c5eb0c6f75e2f41778720e8b3a
ab2a1fe4d98552a10551f494bb32e97ad31de3386e4d263f35a09345d71763c9 - ab2a1fe4d98552a10551f494bb32e97ad31de3386e4d263f35a09345d71763c9
2dfd14837523040c2ab751eb93da940b62076504b416bd7efc4c5327c56676ee - 2dfd14837523040c2ab751eb93da940b62076504b416bd7efc4c5327c56676ee
2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 - 2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800
a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58 - a55d8a932337808d5c872f275ad7918c42490a7da33d288e5f9280e8fd14fa58

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://spaines.pw/EiDQjNbWEQ/

Embedded domains

spaines.pw

Embedded IP addresses

20.42.65.88
52.123.252.238
85.210.193.152
20.247.184.142
172.64.154.167
74.178.240.51
135.233.95.144
20.52.64.200
74.178.240.61
4.230.171.124
92.223.78.30
135.233.45.223
52.110.12.48
52.110.12.10
52.123.252.232
52.148.114.188
52.123.252.222
52.123.252.230
20.42.73.24
20.184.175.10
52.110.12.33
72.153.5.129
216.218.185.162

More TinyBanker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report