MALICIOUS — 5d158a66652bb1e514e3245e94f6cdb52581b95dfdd69671203a046266d370e9

MALICIOUS — 5d158a66652bb1e514e3245e94f6cdb52581b95dfdd69671203a046266d370e9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Flystudio family. 9 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 5d158a66652bb1e514e3245e94f6cdb52581b95dfdd69671203a046266d370e9
• SHA-1: ab00a871984b5a08168ed02da492e7fdb1969477
• MD5: c48c3da8a100cdded5ff51a927da749d
• imphash: da06bd93d6a5615b26448a00003c5c3d
• ssdeep: 24576:6ArW/8hh0FQAq7c8nA7YMv3+DpBNPRI9ovlG4XozaEhptdPYfCG6bYVxXNVD8pVb:6e0mfW3YNPRRlG4saIprQNO
• TLSH: T11B548E3611526656F1E2FAE8A55E4F9C81338D9C31B70FC8DA83E06C33DAC27A017995
• Submitted as: 5d158a66652bb1e514e3245e94f6cdb52581b95dfdd69671203a046266d370e9
• File type: pe · Size: 1144132 bytes
• Verdict: malicious (99/100) · Family: Flystudio

Detections (9 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Malware.Gotango-7000352-0
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Microsoft Defender: Trojan:Win32/Flystudio!pz
• Emsisoft (Emergency Kit): Trojan.GenericKD.38921908
• Kaspersky (KVRT): Trojan.Win32.Agentb.iods

MITRE ATT&CK

• T1547.001
• T1071.001
• T1057
• T1056.001

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

• ClamAV (daily) flagged Win.Malware.Gotango-7000352-0 (rule Win.Malware.Gotango-7000352-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Flystudio!pz (rule Trojan:Win32/Flystudio!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.38921908 (rule Trojan.GenericKD.38921908) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://sf.symcb.com/sf.crl0a, https://d.symcb.com/rpa0, http://sf.symcb.com/sf.crt0 - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://crl.thawte.com/ThawteTimestampingCA.crl0
• http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
• http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
• https://www.verisign.com/rpa
• http://sf.symcb.com/sf.crl0a
• https://d.symcb.com/rpa0
• http://sf.symcb.com/sf.crt0
• https://www.verisign.com/cps0*
• https://www.verisign.com/rpa0
• http://logo.verisign.com/vslogo.gif04
• http://crl.verisign.com/pca3-g5.crl04
• http://sv.symcb.com/sv.crl0a
• http://sv.symcb.com/sv.crt0
• http://www.symauth.com/cps0
• http://www.symauth.com/rpa00
• http://s1.symcb.com/pca3-g5.crl0
• http://www.dywt.com.cn

Embedded domains

• t.it
• htl5656556.u1.luyouxia.net
• proc.name
• crl.thawte.com
• ts-aia.ws.symantec.com
• ts-crl.ws.symantec.com
• www.verisign.com
• sf.symcb.com
• d.symcb.com
• logo.verisign.com
• crl.verisign.com
• sv.symcb.com
• www.symauth.com
• s1.symcb.com
• www.dywt.com.cn

Registry keys

• HKLM\SYSTEM\CurrentControlSet\Control\Terminal

File paths

• C:\ProgramData\Microsoft\Windows\Start
• C:\Documents
• c:\windows\system32\termsrv.dll
• C:\WINDOWS\system32\termsrv.dll
• C:\WINDOWS\system32\Termsrvs.dll

More Flystudio samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report