MALICIOUS — virussign.com_537f86d304fd8fdf2a3a957f1e352f00.vir

MALICIOUS — virussign.com_537f86d304fd8fdf2a3a957f1e352f00.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 9c5b92cf20c1885adec7cee8860739ac99c72c8a82624e28d69e386f05c14fe7
• SHA-1: e6ea5cf2e25d99d5ec9264ac6107fa670e5c884f
• MD5: 537f86d304fd8fdf2a3a957f1e352f00
• imphash: b6230692891661869cecd581561a21f4
• ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXR:zW6ncoyqOp6IsTl/mXR
• TLSH: T1234CBED87AC7CD54E8E97B86E44554BDD68BD12F186D2E8F0392C2386F812F3A472112
• Submitted as: virussign.com_537f86d304fd8fdf2a3a957f1e352f00.vir
• File type: pe · Size: 534782 bytes
• Verdict: malicious (98/100) · Family: Fsysna

Source: VirusSign · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• ClamAV (daily): Win.Worm.Guap-4
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Microsoft Defender: Trojan:Win32/Fsysna!pz
• Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
• Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded domains

• server.com
• tsymantec.com
• tsecurityresponse.symantec.com
• tsarc.com
• twww.sarc.com
• twww.sophos.com
• tsophos.com
• twww.mcafee.com
• tmcafee.com
• tliveupdate.symantecliveupdate.com
• twww.viruslist.com
• tviruslist.com
• tf-secure.com
• twww.f-secure.com
• tf-prot.com
• twww.f-prot.com
• tkaspersky.com
• tkaspersky-labs.com
• twww.avp.com
• tavp.com
• twww.kaspersky.com
• twww.networkassociates.com
• tnetworkassociates.com
• twww.ca.com
• tca.com

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• C:\Program
• C:\WINDOWS\system32\drivers\etc\hosts

More Fsysna samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report