MALICIOUS — f9c3cd6a54b1b892c82a927926be12ebdabfb129bdbcc715cf417cac139a75ab

MALICIOUS — f9c3cd6a54b1b892c82a927926be12ebdabfb129bdbcc715cf417cac139a75ab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Tinba family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: f9c3cd6a54b1b892c82a927926be12ebdabfb129bdbcc715cf417cac139a75ab
SHA-1: de87dc86925a144b87666f64500bd7a59e56cc7c
MD5: 8078867794dcc50d59991e18d8206637
imphash: 1f818038e9a7c00938fb82807a35fdca
ssdeep: 768:Hp22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:HpYoX58z1uirL98xMWnT0OQ9J2
TLSH: T1F22FF1DC22AA5790E37048B83C69646C07F299480D188E4F250A357A94776B7CBFFE13
Submitted as: f9c3cd6a54b1b892c82a927926be12ebdabfb129bdbcc715cf417cac139a75ab
File type: pe · Size: 35332 bytes
Verdict: malicious (100/100) · Family: Tinba

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Packed.Tinba-6973140-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Tinba!pz
Emsisoft (Emergency Kit): Generic.Dacic.19514.EEE79152
Kaspersky (KVRT): HEUR:Backdoor.Win32.Androm.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Packed.Tinba-6973140-0 (rule Win.Packed.Tinba-6973140-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tinba!pz (rule Trojan:Win32/Tinba!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.19514.EEE79152 (rule Generic.Dacic.19514.EEE79152) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Androm.gen (rule HEUR:Backdoor.Win32.Androm.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

33735 behavior events · 3 ATT&CK techniques · 16 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\{81d5dadb-6883-48a2-a20f-64a25ac21af7}.png - f3335e652639a387b7532280039027c9102a7da2b28ce72b336c4634b002c768
C:\Users\analyst\AppData\Roaming\E15FCC87\bin.exe - 5a8fbf8dda62200f90a1dfd7e6f6e009a4c3b30087944c8270a42295ebb98d86
3e879eec851a28aee3e5f7db65d4f91fbd961f29120a1651f3d8d12da061c3e4 - 3e879eec851a28aee3e5f7db65d4f91fbd961f29120a1651f3d8d12da061c3e4
02e7726692d7fa037a78acfff2b5bb7ff387c812f7641217ef73a352df90d078 - 02e7726692d7fa037a78acfff2b5bb7ff387c812f7641217ef73a352df90d078
69f43e614f0dd00967b52871d6a7025575da22e74efd4fd474ff21e990dd7c19 - 69f43e614f0dd00967b52871d6a7025575da22e74efd4fd474ff21e990dd7c19
64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336 - 64c8e69d2838221e8468d24e61d0f8bc79162066bba65aae0684334602b82336
5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515 - 5d7d337bee292d46809afffc76ca926b0eaa3e180d624777400a6f27d6a5e515
129e7eb030a8a943ba650c8363eaf21270d81077fca19b2bc875a4a4204b8017 - 129e7eb030a8a943ba650c8363eaf21270d81077fca19b2bc875a4a4204b8017
da420e7aa4cae95e6e0aeccf5ab2a5fa6cae96bf5d9aaf9dd000fc8cba87f91d - da420e7aa4cae95e6e0aeccf5ab2a5fa6cae96bf5d9aaf9dd000fc8cba87f91d
2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689 - 2b5c5207c9a8cf676922307958ec31d2da9c02b7c9721aa0d506bcb3f16ff689
d5609c06533800ca5041afb47e54babf68deb8ae7f9a97485d02f1fa83d0c130 - d5609c06533800ca5041afb47e54babf68deb8ae7f9a97485d02f1fa83d0c130
9404ee1d6fd8365c29aaf964642f1dfd7404ce0e5c02e5a70ab925f3b1bf74bf - 9404ee1d6fd8365c29aaf964642f1dfd7404ce0e5c02e5a70ab925f3b1bf74bf
b3406f2a25b2b2096d44ff4f358c1e550ea008aad9821580725c997c709ee678 - b3406f2a25b2b2096d44ff4f358c1e550ea008aad9821580725c997c709ee678
4812baea8fcce7af7791745a6c7cbd591dcb142502c9e0b4120537f62df90685 - 4812baea8fcce7af7791745a6c7cbd591dcb142502c9e0b4120537f62df90685
2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800 - 2b2d2813311482ef4ed750054d7eb4730220e560b3e3e822d4f2dedd0ab91800

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://spaines.pw/EiDQjNbWEQ/
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

spaines.pw
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.26
52.230.60.54
52.123.252.202
4.230.171.124
172.178.240.161
48.211.4.16
135.233.45.223
172.215.188.225
184.84.165.171
172.178.240.162
52.168.112.66
104.208.16.94
52.148.114.188
52.110.12.1
52.110.12.4
52.110.12.11
52.110.12.25
72.145.35.106
216.218.185.162

More Tinba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report