Managed XDR

vtdl_h8aq8r7r (Tinba) — malware analysis report

File info

Filename
vtdl_h8aq8r7r
File type
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
File size
496 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
679cd1a5184e02c79bc476235f6c442815158efb
SHA256
c15e49a68fe5dda37168afe99494a168ede1595a1bb866c940bd5d899212d97e
MD5
c563c16ac7114cbce962e86b279ae776

Malwares

  • Tinba

Signatures

Persistence

T1574 dropper_dll: Creates DLL, which is then loaded into the process

Privilege Escalation

T1574 dropper_dll: Creates DLL, which is then loaded into the process

Defense Evasion

T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1574 dropper_dll: Creates DLL, which is then loaded into the process

Other

yara_rules: Static rules
message_box: Displays a message

Related reports