MALICIOUS — b5853fb8d57311196b8f53da84ad838f83558ed6b5a45eccef42abb9ccef2db9
MALICIOUS — b5853fb8d57311196b8f53da84ad838f83558ed6b5a45eccef42abb9ccef2db9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
b5853fb8d57311196b8f53da84ad838f83558ed6b5a45eccef42abb9ccef2db9 - SHA-1:
afa7d224aeb0e0feed5e2ab9c8c8f0c7ce690339 - MD5:
755cd4b0619bf22d672d560e16315582 - imphash:
b6230692891661869cecd581561a21f4 - ssdeep:
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXN:zW6ncoyqOp6IsTl/mXN - TLSH:
T1394CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112 - Submitted as: b5853fb8d57311196b8f53da84ad838f83558ed6b5a45eccef42abb9ccef2db9
- File type: pe · Size: 534767 bytes
- Verdict: malicious (100/100) · Family: Fsysna
Detections (6 of 52 engines)
- ClamAV (daily): Win.Worm.Guap-4
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Trojan:Win32/Fsysna!pz
- Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
- Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Worm.Guap-4 (rule
Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule
Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule
Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 35 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- Extracted BlackShades config (0 C2) - engine signal, weight 0.45, confidence 0.60
- YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
85602 behavior events · 2 ATT&CK techniques · 30 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- v20.events.data.microsoft.com
- desktop-hsgcbep
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- slscr.update.microsoft.com
- v10.events.data.microsoft.com
- watson.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/7649/files/b8830d8ecde7fa157dbbfaeb9aca98eb12a5307b7a0056c9fd4a751cd9c43053 -
b8830d8ecde7fa157dbbfaeb9aca98eb12a5307b7a0056c9fd4a751cd9c43053 - /opt/CAPEv2/storage/analyses/7649/files/dced663b999c913cc5fe17c1915c8c625e4a8c9789c3396c3aff616a0f76a528 -
dced663b999c913cc5fe17c1915c8c625e4a8c9789c3396c3aff616a0f76a528 - /opt/CAPEv2/storage/analyses/7649/files/d96a25a254d67d4d15ed05620a9cbdc80ede1d26df4fca47fde9cfff01edd47a -
d96a25a254d67d4d15ed05620a9cbdc80ede1d26df4fca47fde9cfff01edd47a - /opt/CAPEv2/storage/analyses/7649/files/d69319ba3c0b5a7248f319dc75ce347d656394169a4f24e8685ca48bb3cd5bae -
d69319ba3c0b5a7248f319dc75ce347d656394169a4f24e8685ca48bb3cd5bae - /opt/CAPEv2/storage/analyses/7649/files/5fb6d042b52ee66f780c412db1c6a117f6cacd7c380d04c0bc0cb1c845ac3aa6 -
5fb6d042b52ee66f780c412db1c6a117f6cacd7c380d04c0bc0cb1c845ac3aa6 - /opt/CAPEv2/storage/analyses/7649/files/855eccd5275889a44c259d4273c99ebdb2b3cfc713664dd4254a08c3117faa92 -
855eccd5275889a44c259d4273c99ebdb2b3cfc713664dd4254a08c3117faa92 - /opt/CAPEv2/storage/analyses/7649/files/61d1adddd2a7acbcc145ff08ba5b80e25eb60426289ffd954ae2fec57b523ba1 -
61d1adddd2a7acbcc145ff08ba5b80e25eb60426289ffd954ae2fec57b523ba1 - /opt/CAPEv2/storage/analyses/7649/files/3a64567309306bf8b814d6b4f35d01bfb009bd9d2b699cf7ac7962bbd4f283dc -
3a64567309306bf8b814d6b4f35d01bfb009bd9d2b699cf7ac7962bbd4f283dc - /opt/CAPEv2/storage/analyses/7649/files/0da55e8b66be20db24df631fda41b1a557c3d5e7203529a2112c3a97442a22f1 -
0da55e8b66be20db24df631fda41b1a557c3d5e7203529a2112c3a97442a22f1 - /opt/CAPEv2/storage/analyses/7649/files/49070ba604a90d66c375f0105d71034fab58a4cd45271dd5b0cb05ff01ea6aa3 -
49070ba604a90d66c375f0105d71034fab58a4cd45271dd5b0cb05ff01ea6aa3 - /opt/CAPEv2/storage/analyses/7649/files/79a87e0962b5bca608efde10f05dc6d748284eac3e9b063be2cfe6086955a3a2 -
79a87e0962b5bca608efde10f05dc6d748284eac3e9b063be2cfe6086955a3a2 - /opt/CAPEv2/storage/analyses/7649/files/847d18eae0d753bdb69cf3a4b3a3283ef74daf31d88ad82efa4e5edf2d11e6f7 -
847d18eae0d753bdb69cf3a4b3a3283ef74daf31d88ad82efa4e5edf2d11e6f7 - /opt/CAPEv2/storage/analyses/7649/files/cda91b235e015a92604be5b011559c5c66dd7aa55064b93ea55d09fe6cec62bf -
cda91b235e015a92604be5b011559c5c66dd7aa55064b93ea55d09fe6cec62bf - /opt/CAPEv2/storage/analyses/7649/files/9f50196bf87ca9392544c4c97a03b12605e7ba701887b98cc2c3268011441ece -
9f50196bf87ca9392544c4c97a03b12605e7ba701887b98cc2c3268011441ece - /opt/CAPEv2/storage/analyses/7649/files/8059d7b98b8b629dad309ac7822de4497d5f42556625a7312f1fbed362212555 -
8059d7b98b8b629dad309ac7822de4497d5f42556625a7312f1fbed362212555
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786285511&P2=404&P3=2&P4=AvBCbxD17ZbacWdGV%2fZ%2bWeX2uKzOj3U5tn9TXx%2fRsYKn7hdb30H0oVVA6PtGt0DIBHOO0wan2Gpd0Vpsc%2fBI2w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786285626&P2=404&P3=2&P4=WLICiDaZcK4ItgygtrSHTLORJK3vjIBtgicdKJ2x%2b9HVRRRZbmUJ2%2fC4AEeC%2bLzhWZpqVdFNjIoUOzRxQJ2zJw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- server.com
- tsymantec.com
- tsecurityresponse.symantec.com
- tsarc.com
- twww.sarc.com
- twww.sophos.com
- tsophos.com
- twww.mcafee.com
- tmcafee.com
- tliveupdate.symantecliveupdate.com
- twww.viruslist.com
- tviruslist.com
- tf-secure.com
- twww.f-secure.com
- tf-prot.com
- twww.f-prot.com
- tkaspersky.com
- tkaspersky-labs.com
- twww.avp.com
- tavp.com
- twww.kaspersky.com
- twww.networkassociates.com
- tnetworkassociates.com
- twww.ca.com
- tca.com
Embedded IP addresses
- 20.184.175.6
- 52.123.252.232
- 4.230.171.124
- 52.253.84.76
- 20.42.179.204
- 135.233.95.135
- 74.178.76.128
- 20.184.175.17
- 20.184.175.1
- 135.234.160.244
- 172.178.240.162
- 20.209.154.161
- 203.26.79.13
- 52.123.252.227
- 74.179.71.159
- 72.145.35.115
- 52.148.114.188
- 4.150.223.102
- 20.42.73.24
- 52.110.12.21
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File paths
- C:\Program
- C:\WINDOWS\system32\drivers\etc\hosts
More Fsysna samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report