MALICIOUS — 9d72438542366415407552385b8862238c051d1b25506d6074cde696174e4ccc

MALICIOUS — 9d72438542366415407552385b8862238c051d1b25506d6074cde696174e4ccc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Flystudio family. 10 of 56 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: 9d72438542366415407552385b8862238c051d1b25506d6074cde696174e4ccc
SHA-1: 3178c6a45bfdd5d3754bd4afd277e4ccf5002153
MD5: 0aba6507860ed5d722b1f87364b1e96a
imphash: da06bd93d6a5615b26448a00003c5c3d
ssdeep: 98304:ESWINPRRlG4saIpu3N44WEXP9RElKHa/M:Ec15zSrU
TLSH: T12261D03121012209D1E6EAE85A2E4F4C71734DDCB4BA4FD49673E09C329BC97B0BAD56
Submitted as: 9d72438542366415407552385b8862238c051d1b25506d6074cde696174e4ccc
File type: pe · Size: 3991115 bytes
Verdict: malicious (100/100) · Family: Flystudio

Detections (10 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Gotango-7000352-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
Microsoft Defender: Trojan:Win32/Flystudio!pz
Emsisoft (Emergency Kit): Trojan.GenericKD.38921908
Kaspersky (KVRT): Trojan.Win32.Agentb.iods

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 24 weighted signals:

ClamAV (daily) flagged Win.Malware.Gotango-7000352-0 (rule Win.Malware.Gotango-7000352-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Trojan:Win32/Flystudio!pz (rule Trojan:Win32/Flystudio!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.38921908 (rule Trojan.GenericKD.38921908) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agentb.iods (rule Trojan.Win32.Agentb.iods) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.40, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://sf.symcb.com/sf.crl0a, https://d.symcb.com/rpa0, http://sf.symcb.com/sf.crt0 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

31364 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Microsoft\svchcst.exe - 06bdc25387deb0aa54db5e81489fb0057d4c8891b772197323b0271d329078ff
C:\Users\analyst\AppData\Roaming\Microsoft\VBS3.vbs - 3268831f61a827e7470ef76d08aafb9fab41ebecfdc3d696a4e95543ee9b1aeb

Embedded URLs

http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
https://www.verisign.com/rpa
http://sf.symcb.com/sf.crl0a
https://d.symcb.com/rpa0
http://sf.symcb.com/sf.crt0
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
http://logo.verisign.com/vslogo.gif04
http://crl.verisign.com/pca3-g5.crl04
http://sv.symcb.com/sv.crl0a
http://sv.symcb.com/sv.crt0
http://www.symauth.com/cps0
http://www.symauth.com/rpa00
http://s1.symcb.com/pca3-g5.crl0
https://www.2fzm.com/
http://www.dywt.com.cn
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

t.it
htl5656556.u1.luyouxia.net
proc.name
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
www.verisign.com
sf.symcb.com
d.symcb.com
logo.verisign.com
crl.verisign.com
sv.symcb.com
www.symauth.com
s1.symcb.com
8b.be
www.2fzm.com
www.dywt.com.cn

Embedded IP addresses

52.168.117.174
52.253.84.76
4.230.171.124
135.234.160.245
172.178.240.162
52.110.12.18
135.233.45.223
172.215.188.225
172.215.188.232
72.153.5.132
52.148.114.188
52.110.12.40
52.110.12.46

Registry keys

HKLM\SYSTEM\CurrentControlSet\Control\Terminal

File paths

C:\ProgramData\Microsoft\Windows\Start
C:\Documents
c:\windows\system32\termsrv.dll
C:\WINDOWS\system32\termsrv.dll
C:\WINDOWS\system32\Termsrvs.dll
h:\J
D:\:t:
X:\:t:
X:\:`:d:h:p:t:
X:\:`:d:
T:\:d:l:t:
X:\:`:l:p:t:
X:\:`:d:l:p:t:x:

More Flystudio samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report