MALICIOUS — ab87a52181c6d4e502e4a1e8b406c95f71ff884640ceda866ac44339349f9911

MALICIOUS — ab87a52181c6d4e502e4a1e8b406c95f71ff884640ceda866ac44339349f9911 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: ab87a52181c6d4e502e4a1e8b406c95f71ff884640ceda866ac44339349f9911
SHA-1: ca15fdc1965518a0e7b20ebe1cd80f5186309ccc
MD5: 3dd4564c5b4d30c3d24851ccc23d22e4
imphash: b6230692891661869cecd581561a21f4
ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXu:zW6ncoyqOp6IsTl/mXu
TLSH: T1564CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112
Submitted as: ab87a52181c6d4e502e4a1e8b406c95f71ff884640ceda866ac44339349f9911
File type: pe · Size: 534761 bytes
Verdict: malicious (100/100) · Family: Fsysna

Detections (6 of 52 engines)

ClamAV (daily): Win.Worm.Guap-4
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
Microsoft Defender: Trojan:Win32/Fsysna!pz
Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Extracted BlackShades config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

87499 behavior events · 2 ATT&CK techniques · 30 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7680/files/9d1a8fd5e7cab78518f45984881f87f05b17c6309d0c5e8519708edfe5d5294d - 9d1a8fd5e7cab78518f45984881f87f05b17c6309d0c5e8519708edfe5d5294d
/opt/CAPEv2/storage/analyses/7680/files/896467e701e4bf5397b5dc117d754c841e7c4953c71286bfd5f264fa4221147b - 896467e701e4bf5397b5dc117d754c841e7c4953c71286bfd5f264fa4221147b
/opt/CAPEv2/storage/analyses/7680/files/a7c26e2062f1328146ca60b15f161a85e710f7d358c48baf6d797ace92f90883 - a7c26e2062f1328146ca60b15f161a85e710f7d358c48baf6d797ace92f90883
/opt/CAPEv2/storage/analyses/7680/files/66a193338b75948376cd1c0db7d96d2ee6caf02375bba3bfd32e11d791163b6e - 66a193338b75948376cd1c0db7d96d2ee6caf02375bba3bfd32e11d791163b6e
/opt/CAPEv2/storage/analyses/7680/files/7bc129a5fd79828223072914ba07449030a3dfa0f7f19b5350d5b472f74d3d1c - 7bc129a5fd79828223072914ba07449030a3dfa0f7f19b5350d5b472f74d3d1c
/opt/CAPEv2/storage/analyses/7680/files/ce37854a66a018e9a37319ad7639b0aad1593c0219fb589328e5f8037861d1a9 - ce37854a66a018e9a37319ad7639b0aad1593c0219fb589328e5f8037861d1a9
/opt/CAPEv2/storage/analyses/7680/files/697855636159d70ace8b514fd6dafecd8d1d24097743d14ac46de6bbe6b239fb - 697855636159d70ace8b514fd6dafecd8d1d24097743d14ac46de6bbe6b239fb
/opt/CAPEv2/storage/analyses/7680/files/8db98277699508d6149d81ae4accce0a28f8cbac966105710e64ce5e845aef36 - 8db98277699508d6149d81ae4accce0a28f8cbac966105710e64ce5e845aef36
/opt/CAPEv2/storage/analyses/7680/files/1e73366e73882001cfa5a9e0f0a667efc15f9358404515a8169dfb5fc109f5a8 - 1e73366e73882001cfa5a9e0f0a667efc15f9358404515a8169dfb5fc109f5a8
/opt/CAPEv2/storage/analyses/7680/files/90268814152022d47e7ebb060b22b2bb3b8f4db2fb697eea0900a605fbf99d78 - 90268814152022d47e7ebb060b22b2bb3b8f4db2fb697eea0900a605fbf99d78
/opt/CAPEv2/storage/analyses/7680/files/d9c5266112f4fcc9569c381af24159b4b77cf3ff8cceb9296ee286415df94602 - d9c5266112f4fcc9569c381af24159b4b77cf3ff8cceb9296ee286415df94602
/opt/CAPEv2/storage/analyses/7680/files/316ae8a3ee27d1ae992979deae6d006dc0ffae9926278c5af6c63cf920289d6e - 316ae8a3ee27d1ae992979deae6d006dc0ffae9926278c5af6c63cf920289d6e
/opt/CAPEv2/storage/analyses/7680/files/4d7375b69775de5f04ee8cdb35b4990468e0696ab7d9684ccd6d896f72aca7ca - 4d7375b69775de5f04ee8cdb35b4990468e0696ab7d9684ccd6d896f72aca7ca
/opt/CAPEv2/storage/analyses/7680/files/25bb01cd3e3d15c62d696c593e2f84b790173497106e25892afc45180e8db1bf - 25bb01cd3e3d15c62d696c593e2f84b790173497106e25892afc45180e8db1bf
/opt/CAPEv2/storage/analyses/7680/files/34cc89a0656b9a61f9480f76f11237d08d0ffff14fcdd5eb8a273f480c52521a - 34cc89a0656b9a61f9480f76f11237d08d0ffff14fcdd5eb8a273f480c52521a

Embedded domains

server.com
tsymantec.com
tsecurityresponse.symantec.com
tsarc.com
twww.sarc.com
twww.sophos.com
tsophos.com
twww.mcafee.com
tmcafee.com
tliveupdate.symantecliveupdate.com
twww.viruslist.com
tviruslist.com
tf-secure.com
twww.f-secure.com
tf-prot.com
twww.f-prot.com
tkaspersky.com
tkaspersky-labs.com
twww.avp.com
tavp.com
twww.kaspersky.com
twww.networkassociates.com
tnetworkassociates.com
twww.ca.com
tca.com

Embedded IP addresses

162.159.36.2

Registry keys

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

C:\Program
C:\WINDOWS\system32\drivers\etc\hosts

More Fsysna samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report