MALICIOUS — a1c73f04bd3f543658b4d635a770f21489b17e7f4f9ad27ab9d0aa8a8a80bf0e

MALICIOUS — a1c73f04bd3f543658b4d635a770f21489b17e7f4f9ad27ab9d0aa8a8a80bf0e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: a1c73f04bd3f543658b4d635a770f21489b17e7f4f9ad27ab9d0aa8a8a80bf0e
SHA-1: 75979170b8f0f996f20970b7899ed3fa81d9d4ac
MD5: bf2537a7c60ec47e296fcb160f476666
imphash: b6230692891661869cecd581561a21f4
ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXY:zW6ncoyqOp6IsTl/mXY
TLSH: T1644CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112
Submitted as: a1c73f04bd3f543658b4d635a770f21489b17e7f4f9ad27ab9d0aa8a8a80bf0e
File type: pe · Size: 534743 bytes
Verdict: malicious (100/100) · Family: Fsysna

Detections (6 of 52 engines)

ClamAV (daily): Win.Worm.Guap-4
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
Microsoft Defender: Trojan:Win32/Fsysna!pz
Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. process hollowing in service.exe (pid 3136) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 34 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Extracted BlackShades config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

81397 behavior events · 2 ATT&CK techniques · 30 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7601/files/ee7a9a304e9005dfc6f10b649deb60400c459b2c0841e3dad18b5e01fc1f9a45 - ee7a9a304e9005dfc6f10b649deb60400c459b2c0841e3dad18b5e01fc1f9a45
/opt/CAPEv2/storage/analyses/7601/files/09b0de518bd494c68769b008b03c42747caf83673e34e2d856dc146e0c277a17 - 09b0de518bd494c68769b008b03c42747caf83673e34e2d856dc146e0c277a17
/opt/CAPEv2/storage/analyses/7601/files/ecba6d1f4163c63aaa047e664b1171f325b648ad46bb46a72e0a47f9e0b71a61 - ecba6d1f4163c63aaa047e664b1171f325b648ad46bb46a72e0a47f9e0b71a61
/opt/CAPEv2/storage/analyses/7601/files/49d6d842e9fcd9724e94f5f8a55ea4da42bf88f51950d1e68760b6b7010e124f - 49d6d842e9fcd9724e94f5f8a55ea4da42bf88f51950d1e68760b6b7010e124f
/opt/CAPEv2/storage/analyses/7601/files/0714e252f2ab53060fd771aac7b7e995db258545600f2371fe74ea53b9e19d39 - 0714e252f2ab53060fd771aac7b7e995db258545600f2371fe74ea53b9e19d39
/opt/CAPEv2/storage/analyses/7601/files/f224457a98eb4ff8daba31a6c8d0cd29e3beabc6a1376f718455fd496cb76e8c - f224457a98eb4ff8daba31a6c8d0cd29e3beabc6a1376f718455fd496cb76e8c
/opt/CAPEv2/storage/analyses/7601/files/0cd4db77882ea08424a3281320fd8285e67c52caa3bd7ef4c8f0e765622f4a4b - 0cd4db77882ea08424a3281320fd8285e67c52caa3bd7ef4c8f0e765622f4a4b
/opt/CAPEv2/storage/analyses/7601/files/bed48dce944c9df53f95c3ca7a2bfe4c32a345312db50becb3661129cfcf4f4d - bed48dce944c9df53f95c3ca7a2bfe4c32a345312db50becb3661129cfcf4f4d
/opt/CAPEv2/storage/analyses/7601/files/37c2c54aad303d31c5cd57e6c16d963685311252115d49bd5d11d64d570f6dec - 37c2c54aad303d31c5cd57e6c16d963685311252115d49bd5d11d64d570f6dec
/opt/CAPEv2/storage/analyses/7601/files/f4dd52e82603cc4c3fcb015153277c571b244e0cd8a9b0ce343f50b6d06db596 - f4dd52e82603cc4c3fcb015153277c571b244e0cd8a9b0ce343f50b6d06db596
/opt/CAPEv2/storage/analyses/7601/files/1ace067efab5b1d2acc6f70f9ce1ec328af35524229aa315d600976cae274e2a - 1ace067efab5b1d2acc6f70f9ce1ec328af35524229aa315d600976cae274e2a
/opt/CAPEv2/storage/analyses/7601/files/20820633ebf41d30e945d0cb72d94670cfd9e6f322484ab8aad6915e65d1a6ec - 20820633ebf41d30e945d0cb72d94670cfd9e6f322484ab8aad6915e65d1a6ec
/opt/CAPEv2/storage/analyses/7601/files/52662bc9204787bbcea979033772e674d1e64d13cbf0dedb9e993af819daa57b - 52662bc9204787bbcea979033772e674d1e64d13cbf0dedb9e993af819daa57b
/opt/CAPEv2/storage/analyses/7601/files/2f4637da708fe92cee6f6266247bb35eced0c43b9ffecf5b722e2d85db8ee236 - 2f4637da708fe92cee6f6266247bb35eced0c43b9ffecf5b722e2d85db8ee236
/opt/CAPEv2/storage/analyses/7601/files/7f123e9170d19d68101e5225d2275b253434e4ee60954daff44274ba8dbf8bef - 7f123e9170d19d68101e5225d2275b253434e4ee60954daff44274ba8dbf8bef

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786281800&P2=404&P3=2&P4=XrPCr8f%2bYOzAaFGJSkQwBpkyXZ%2f7BNYiv97Hc77sO1S8WciYBVhXRad4QZ0nYBATIuq%2bkGXnI1jzGMFFL2h6Zw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786281902&P2=404&P3=2&P4=ZAvBZwBxkwRppKTxBg%2f6WKVGtZ6F0JXLnvauj%2bnKP5QaG7p973xl%2b1j5xsfbfB7wmxYzmBmCmOjixb8nH%2b0Zdw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

server.com
tsymantec.com
tsecurityresponse.symantec.com
tsarc.com
twww.sarc.com
twww.sophos.com
tsophos.com
twww.mcafee.com
tmcafee.com
tliveupdate.symantecliveupdate.com
twww.viruslist.com
tviruslist.com
tf-secure.com
twww.f-secure.com
tf-prot.com
twww.f-prot.com
tkaspersky.com
tkaspersky-labs.com
twww.avp.com
tavp.com
twww.kaspersky.com
twww.networkassociates.com
tnetworkassociates.com
twww.ca.com
tca.com

Embedded IP addresses

4.150.223.113
20.42.179.192
4.230.171.124
20.247.185.124
74.178.240.51
40.79.163.154
74.179.77.204
172.178.240.163
135.234.160.244
203.26.79.13
52.123.252.212
135.232.92.34
40.79.197.34
20.42.65.93
52.148.114.188
72.154.7.111
92.223.78.30
52.110.12.16
52.110.12.25

Registry keys

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

C:\Program
C:\WINDOWS\system32\drivers\etc\hosts

More Fsysna samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report