MALICIOUS — 27d1055875f32eb8cd3c058dd05b058811adba98294b5158561a25f1dcd7fa9c
MALICIOUS — 27d1055875f32eb8cd3c058dd05b058811adba98294b5158561a25f1dcd7fa9c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
27d1055875f32eb8cd3c058dd05b058811adba98294b5158561a25f1dcd7fa9c - SHA-1:
6d5b0f53d01923dfee898d4d4ca7ee33ce298aed - MD5:
353909ad4d435b6f46c00f5eada90cf9 - imphash:
b6230692891661869cecd581561a21f4 - ssdeep:
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXc:zW6ncoyqOp6IsTl/mXc - TLSH:
T1174CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112 - Submitted as: 27d1055875f32eb8cd3c058dd05b058811adba98294b5158561a25f1dcd7fa9c
- File type: pe · Size: 534758 bytes
- Verdict: malicious (100/100) · Family: Fsysna
Detections (6 of 52 engines)
- ClamAV (daily): Win.Worm.Guap-4
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Trojan:Win32/Fsysna!pz
- Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
- Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 14 weighted signals:
- ClamAV (daily) flagged Win.Worm.Guap-4 (rule
Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule
Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule
Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Fsysna.gevi (rule
Trojan.Win32.Fsysna.gevi) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 32 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
- Extracted BlackShades config (0 C2) - engine signal, weight 0.45, confidence 0.60
- YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
89132 behavior events · 2 ATT&CK techniques · 33 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- msedge.api.cdp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- assets.msn.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- licensing.mp.microsoft.com
- msedge.b.tlu.dl.delivery.mp.microsoft.com
- www.bing.com
Dropped files
- /opt/CAPEv2/storage/analyses/7714/files/cfcb9c508d5aed656ae8f295d45fa3ee0139c0c7691bcd557b7b50c0e0995d38 -
cfcb9c508d5aed656ae8f295d45fa3ee0139c0c7691bcd557b7b50c0e0995d38 - /opt/CAPEv2/storage/analyses/7714/files/26b39224d64d8caf55d46713cad343a61aef4db8a45189b3337e76c9fed2ac7f -
26b39224d64d8caf55d46713cad343a61aef4db8a45189b3337e76c9fed2ac7f - /opt/CAPEv2/storage/analyses/7714/files/5b47509242ce4ad933b32e801f1da8ca2ffb04c0612b6dc36dec9aa7b1436494 -
5b47509242ce4ad933b32e801f1da8ca2ffb04c0612b6dc36dec9aa7b1436494 - /opt/CAPEv2/storage/analyses/7714/files/a63df3314e3f3b9ebfa2735cf0bc46b26d5aa08732a41ccfe6ea613e4c61cf05 -
a63df3314e3f3b9ebfa2735cf0bc46b26d5aa08732a41ccfe6ea613e4c61cf05 - /opt/CAPEv2/storage/analyses/7714/files/4f0cab9f3481bec0ce64facfadcdadb09f513b60f93c38fd528db82115617f7a -
4f0cab9f3481bec0ce64facfadcdadb09f513b60f93c38fd528db82115617f7a - /opt/CAPEv2/storage/analyses/7714/files/d5f2ca4ee4848264c9c4f619d2a4f89c2d25e4425526b38683f3c6c313d5912c -
d5f2ca4ee4848264c9c4f619d2a4f89c2d25e4425526b38683f3c6c313d5912c - /opt/CAPEv2/storage/analyses/7714/files/1f8ccc0afdc3ed4ccafdc43f249f2591eee3738c4c6ed2e5ecbd63f5ccf49382 -
1f8ccc0afdc3ed4ccafdc43f249f2591eee3738c4c6ed2e5ecbd63f5ccf49382 - /opt/CAPEv2/storage/analyses/7714/files/fa05636ab1828257b535f1d1cb0ed95244e14efcce32d5ac85248010315ae4da -
fa05636ab1828257b535f1d1cb0ed95244e14efcce32d5ac85248010315ae4da - /opt/CAPEv2/storage/analyses/7714/files/93ac1ed4be9af4e3b5e8e3b9ddd18664034110b17f18c1fe9227f7d2dab2a6e0 -
93ac1ed4be9af4e3b5e8e3b9ddd18664034110b17f18c1fe9227f7d2dab2a6e0 - /opt/CAPEv2/storage/analyses/7714/files/93432845e269796ad04241df619c677997d52034dc38aeb7fc6ab4109f2358f0 -
93432845e269796ad04241df619c677997d52034dc38aeb7fc6ab4109f2358f0 - /opt/CAPEv2/storage/analyses/7714/files/6c7ffab27cae4f82feaec6ae227a97ecbfd53ed36451f89f0c35c18233dfd847 -
6c7ffab27cae4f82feaec6ae227a97ecbfd53ed36451f89f0c35c18233dfd847 - /opt/CAPEv2/storage/analyses/7714/files/c82e960ebce3503638242e6d665265adf9ddbcf241a7603ae4cd17d98cca9e9a -
c82e960ebce3503638242e6d665265adf9ddbcf241a7603ae4cd17d98cca9e9a - /opt/CAPEv2/storage/analyses/7714/files/110da910439c5cd3d86ef313d89308944aef76196b16cc22950747000412fd1a -
110da910439c5cd3d86ef313d89308944aef76196b16cc22950747000412fd1a - /opt/CAPEv2/storage/analyses/7714/files/7e11fcc86c233657b074ae1108ee14e4dc8c922172fb3aa3ba89bcc0e29351b1 -
7e11fcc86c233657b074ae1108ee14e4dc8c922172fb3aa3ba89bcc0e29351b1 - /opt/CAPEv2/storage/analyses/7714/files/94fd3ecd31f6e26af0156cf97a0cecc308d22ba4401aaaaab02cd9dcf53c93a6 -
94fd3ecd31f6e26af0156cf97a0cecc308d22ba4401aaaaab02cd9dcf53c93a6
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786290922&P2=404&P3=2&P4=fz7H2lMso72kXkdN0TR%2fmCvpxFTNJKe0RKA8Js1xX50h%2f%2bYixIYkKGatCaX%2fyl8HUY0mu1ndHHDyKgo0enKMcg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786290981&P2=404&P3=2&P4=e3bF59QE2Rs5qsWkFoZphO0Qml9UMXcb0Q8u149PO%2bJkXm6ozf95ZSZgtNrC9YvssQOnOl7YaL%2bwmctpK%2bjvKg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- server.com
- tsymantec.com
- tsecurityresponse.symantec.com
- tsarc.com
- twww.sarc.com
- twww.sophos.com
- tsophos.com
- twww.mcafee.com
- tmcafee.com
- tliveupdate.symantecliveupdate.com
- twww.viruslist.com
- tviruslist.com
- tf-secure.com
- twww.f-secure.com
- tf-prot.com
- twww.f-prot.com
- tkaspersky.com
- tkaspersky-labs.com
- twww.avp.com
- tavp.com
- twww.kaspersky.com
- twww.networkassociates.com
- tnetworkassociates.com
- twww.ca.com
- tca.com
Embedded IP addresses
- 4.150.223.104
- 4.247.188.224
- 4.230.171.124
- 52.230.60.54
- 135.233.95.80
- 135.232.92.97
- 74.178.76.128
- 4.150.223.107
- 203.26.79.13
- 4.150.223.102
- 135.234.160.246
- 172.178.240.161
- 72.153.5.96
- 48.211.4.16
- 52.148.114.188
- 92.223.78.30
- 52.110.12.19
- 52.110.12.55
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File paths
- C:\Program
- C:\WINDOWS\system32\drivers\etc\hosts
More Fsysna samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report