MALICIOUS — virussign.com_86f8b38dcc1c5c73abda0b20c93633f0.vir

MALICIOUS — virussign.com_86f8b38dcc1c5c73abda0b20c93633f0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fasong family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 2b63ffd32005bc586522512c0ac5aba242f4f5a60f543aecdfb61b7a6f87de70
• SHA-1: fc20f65a0b7d431371d5c87517010f66198eec62
• MD5: 86f8b38dcc1c5c73abda0b20c93633f0
• imphash: 9d3b7dc2b70a7141008d23acc65769c8
• ssdeep: 12288:OOOZpUtlwX+zc7V5Rn1JyfP8L14A1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJCmer5:IZhNrRCfPbAVDKUTbQIzFLwL
• TLSH: T1CF5849AD31E9579FCD7ECC4E98480B9D223914FA3374EC68424591E878EA9333F5016A
• Submitted as: virussign.com_86f8b38dcc1c5c73abda0b20c93633f0.vir
• File type: pe · Size: 1739034 bytes
• Verdict: malicious (99/100) · Family: Fasong

Detections (7 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Malware.Fasong-9910797-0
• YARA: delivr.to detections: DLV_HTML_Smuggling
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Worm:Win32/Fasong.C
• Emsisoft (Emergency Kit): Gen:Trojan.ShellReg.Q9Y@aK5CV1ib
• Kaspersky (KVRT): Worm.Win32.Fasong.c

MITRE ATT&CK

• T1547.001
• T1057
• T1056.001

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged Win.Malware.Fasong-9910797-0 (rule Win.Malware.Fasong-9910797-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Worm:Win32/Fasong.C (rule Worm:Win32/Fasong.C) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Trojan.ShellReg.Q9Y@aK5CV1ib (rule Gen:Trojan.ShellReg.Q9Y@aK5CV1ib) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Worm.Win32.Fasong.c (rule Worm.Win32.Fasong.c) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_HTML_Smuggling (rule DLV_HTML_Smuggling) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.netmastersllc.com, http://example-cmdline.test, http://example.test/path - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.netmastersllc.com
• http://example-cmdline.test
• http://example.test/path
• http://example2.test/?query
• http://example.test.file
• http://example.test
• http://example2.test
• https://www.example.com/
• https://clients1.google.com/tbproxy
• https://content-autofill.googleapis.com/
• http://www.google.com/
• https://example.com/
• https://chromium.org
• https://chromium.org/
• https://www.google.com
• http://foo.com/
• http://foo.com/#:~:text=hello%20world
• http://foo.com/#:~:text=hello
• http://facebook.com/my-profile
• http://foo.com/#bar
• http://foo.com/#bar:~:text=hello%20world
• http://foo.com/#bar:~:text=baz
• http://foo.com/#bar:~:text=baz&text=qux
• http://foo.com/#bar:~:baz=keep&text=remove&baz=keep2
• http://foo.com/#bar:~:baz=keep&baz=keep2&text=hello%20world

Embedded domains

• netmastersllc.com
• www.netmastersllc.com
• stack.cc
• field.cc
• logging.cc
• blink.net
• zip.cc
• pickle.cc
• www.example.com
• initech.com
• gmail.com
• a.com
• b.com
• clients1.google.com
• content-autofill.googleapis.com
• bounds.top
• wonderland.com
• www.google.com
• foo.com
• example.com
• chromium.org
• facebook.com
• start.com
• bar.com
• window.name

Embedded IP addresses

• 185.228.168.10
• 185.228.169.11
• 185.228.168.168
• 185.228.169.168
• 185.228.168.9
• 185.228.169.9
• 1.1.1.1
• 1.0.0.1
• 75.75.75.75
• 75.75.76.76
• 68.105.28.11
• 68.105.28.12
• 185.43.135.1
• 193.17.47.1
• 185.222.222.222
• 45.11.45.11
• 8.8.8.8
• 8.8.4.4
• 208.67.222.222
• 208.67.220.220
• 208.67.222.123
• 208.67.220.123
• 9.9.9.11
• 149.112.112.11
• 9.9.9.10

File paths

• c:\filedebug
• K:\:
• X:\:`:d:h:l:p:t:x:
• X:\:`:d:h:p:t:x:
• C:\TEMP

More Fasong samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report