MALICIOUS — 3893992f46f2545553f0b060430d4c0add0af1e95326c88b5f62591670812aea

MALICIOUS — 3893992f46f2545553f0b060430d4c0add0af1e95326c88b5f62591670812aea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 3893992f46f2545553f0b060430d4c0add0af1e95326c88b5f62591670812aea
SHA-1: d766cec1cab187a2bb1c6048031c50adb0cc519d
MD5: 66d4218e3de5001b7fec3435562cdc19
imphash: b6230692891661869cecd581561a21f4
ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXr:zW6ncoyqOp6IsTl/mXr
TLSH: T1C74CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112
Submitted as: 3893992f46f2545553f0b060430d4c0add0af1e95326c88b5f62591670812aea
File type: pe · Size: 534776 bytes
Verdict: malicious (100/100) · Family: Fsysna

Detections (6 of 52 engines)

ClamAV (daily): Win.Worm.Guap-4
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
Microsoft Defender: Trojan:Win32/Fsysna!pz
Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Extracted BlackShades config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

82792 behavior events · 2 ATT&CK techniques · 29 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7665/files/6e3da4877acd7148f63ae906c20859a04bba6633966b3c28e742605671d2fcd8 - 6e3da4877acd7148f63ae906c20859a04bba6633966b3c28e742605671d2fcd8
/opt/CAPEv2/storage/analyses/7665/files/1bb5794c8f43be0df4816a43359f7154c7ac1b93647d08d6ff0bb32a658ad9d0 - 1bb5794c8f43be0df4816a43359f7154c7ac1b93647d08d6ff0bb32a658ad9d0
/opt/CAPEv2/storage/analyses/7665/files/c14e3b1b849b1600779cb4ec2350b12bee4c3d055f73e493fe8532de3f483f5c - c14e3b1b849b1600779cb4ec2350b12bee4c3d055f73e493fe8532de3f483f5c
/opt/CAPEv2/storage/analyses/7665/files/572f86a7078af75265280f921b6b9e2cc3ea34757487c07c39cbfa601c0845cd - 572f86a7078af75265280f921b6b9e2cc3ea34757487c07c39cbfa601c0845cd
/opt/CAPEv2/storage/analyses/7665/files/de7a73ac093cd15e24a54e358b611da34cd69ae9c76345af1e9be308035fab2b - de7a73ac093cd15e24a54e358b611da34cd69ae9c76345af1e9be308035fab2b
/opt/CAPEv2/storage/analyses/7665/files/60cae6863481ff6c47c4ed5e7cc0df172fac3f51f57211b2c89d85b6ae84a1b6 - 60cae6863481ff6c47c4ed5e7cc0df172fac3f51f57211b2c89d85b6ae84a1b6
/opt/CAPEv2/storage/analyses/7665/files/355bc3f43785fee183071d2e945ebac1b2a38f483a86920b5a04955074f02e9c - 355bc3f43785fee183071d2e945ebac1b2a38f483a86920b5a04955074f02e9c
/opt/CAPEv2/storage/analyses/7665/files/5f0f466881836a68de2c6d74bf0c7bec3809828f9615ca3057260026a1abf8eb - 5f0f466881836a68de2c6d74bf0c7bec3809828f9615ca3057260026a1abf8eb
/opt/CAPEv2/storage/analyses/7665/files/334db928f881a2c12828522357f3718d28802b0d62005d067004d2c6b519cbcd - 334db928f881a2c12828522357f3718d28802b0d62005d067004d2c6b519cbcd
/opt/CAPEv2/storage/analyses/7665/files/24d04e8f75f23bd89c196872d7b7c5d651e2b1cd0da730dc71a591bc77967bbd - 24d04e8f75f23bd89c196872d7b7c5d651e2b1cd0da730dc71a591bc77967bbd
/opt/CAPEv2/storage/analyses/7665/files/9fc529a2bef047e079b20184ad48010c5003e8344fa1b9bc693bf357928612c8 - 9fc529a2bef047e079b20184ad48010c5003e8344fa1b9bc693bf357928612c8
/opt/CAPEv2/storage/analyses/7665/files/a9fc884be2d9e67f71bafeba4457c0bbce63fe2958c80412618b90468f938595 - a9fc884be2d9e67f71bafeba4457c0bbce63fe2958c80412618b90468f938595
/opt/CAPEv2/storage/analyses/7665/files/e211f070ad597856ffde491de2ac6906c391fa5af8d4bc3adad4f7f322ad6e2b - e211f070ad597856ffde491de2ac6906c391fa5af8d4bc3adad4f7f322ad6e2b
/opt/CAPEv2/storage/analyses/7665/files/1d599bbcd9d6df074f1c23fa898e1a38db334df943b15b1afc5e47754194216a - 1d599bbcd9d6df074f1c23fa898e1a38db334df943b15b1afc5e47754194216a
/opt/CAPEv2/storage/analyses/7665/files/fc4cd2cfdfeb7732b9a4d9b3e762aec8025440c06f52862024dff0a55c6b2ab4 - fc4cd2cfdfeb7732b9a4d9b3e762aec8025440c06f52862024dff0a55c6b2ab4

Embedded domains

server.com
tsymantec.com
tsecurityresponse.symantec.com
tsarc.com
twww.sarc.com
twww.sophos.com
tsophos.com
twww.mcafee.com
tmcafee.com
tliveupdate.symantecliveupdate.com
twww.viruslist.com
tviruslist.com
tf-secure.com
twww.f-secure.com
tf-prot.com
twww.f-prot.com
tkaspersky.com
tkaspersky-labs.com
twww.avp.com
tavp.com
twww.kaspersky.com
twww.networkassociates.com
tnetworkassociates.com
twww.ca.com
tca.com

Embedded IP addresses

162.159.36.2

Registry keys

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

C:\Program
C:\WINDOWS\system32\drivers\etc\hosts

More Fsysna samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report