MALICIOUS — bdaad5153b818572ffb890a0e73398a61652a35020bc8ada2e32242be21e1e55

MALICIOUS — bdaad5153b818572ffb890a0e73398a61652a35020bc8ada2e32242be21e1e55 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: bdaad5153b818572ffb890a0e73398a61652a35020bc8ada2e32242be21e1e55
SHA-1: 17ed05f43421282a0709869356247f8fdc711dd6
MD5: 062c93744b7df345e722f23b56923fd3
imphash: b6230692891661869cecd581561a21f4
ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXg:zW6ncoyqOp6IsTl/mXg
TLSH: T1644CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112
Submitted as: bdaad5153b818572ffb890a0e73398a61652a35020bc8ada2e32242be21e1e55
File type: pe · Size: 534767 bytes
Verdict: malicious (100/100) · Family: Fsysna

Detections (6 of 52 engines)

ClamAV (daily): Win.Worm.Guap-4
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
Microsoft Defender: Trojan:Win32/Fsysna!pz
Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Anti-analysis: T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

79751 behavior events · 2 ATT&CK techniques · 27 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7659/files/faf6112cde7b45010bdd7597ade3af4817ccce08a1401c2eaa20198e22dc2437 - faf6112cde7b45010bdd7597ade3af4817ccce08a1401c2eaa20198e22dc2437
/opt/CAPEv2/storage/analyses/7659/files/b533d73976c63b8a9dccf97627c01892f5b832e0bdf32bb8a38fe6305a65f41c - b533d73976c63b8a9dccf97627c01892f5b832e0bdf32bb8a38fe6305a65f41c
/opt/CAPEv2/storage/analyses/7659/files/5013061a4ef4c9bbbdc2b1560d0e42f52fff9660e4e1334e260ec9ecf6bfda5b - 5013061a4ef4c9bbbdc2b1560d0e42f52fff9660e4e1334e260ec9ecf6bfda5b
/opt/CAPEv2/storage/analyses/7659/files/bfaa41c78737bf86a6d549c334d5c80669e9dba4746a549528d3ff9a7bf323e5 - bfaa41c78737bf86a6d549c334d5c80669e9dba4746a549528d3ff9a7bf323e5
/opt/CAPEv2/storage/analyses/7659/files/dfb9bd1fcea0d75b9718715da395a77947709e0d7cfd9c3346836004ad637ebf - dfb9bd1fcea0d75b9718715da395a77947709e0d7cfd9c3346836004ad637ebf
/opt/CAPEv2/storage/analyses/7659/files/3ab05a952c4573788df4de506e0a7a8c129b76084d66dc253c872673ef796367 - 3ab05a952c4573788df4de506e0a7a8c129b76084d66dc253c872673ef796367
/opt/CAPEv2/storage/analyses/7659/files/116d27d4500b2c131fa32211a68fbd39bcec06693e0e5c6f378ba4b6b5ec59f4 - 116d27d4500b2c131fa32211a68fbd39bcec06693e0e5c6f378ba4b6b5ec59f4
/opt/CAPEv2/storage/analyses/7659/files/d2a90ed7e63410db9ce8958ff71d6130e77aa1e7c5fdf3a9f737b611686e31c8 - d2a90ed7e63410db9ce8958ff71d6130e77aa1e7c5fdf3a9f737b611686e31c8
/opt/CAPEv2/storage/analyses/7659/files/947c2a44f061f907be0507f036e40e2acec14e54faea1c56a77a1f39048b63dd - 947c2a44f061f907be0507f036e40e2acec14e54faea1c56a77a1f39048b63dd
/opt/CAPEv2/storage/analyses/7659/files/8fa6f1c6fd8dd76063c08164534b21c87071c7cbb3cc9b1c8378bb62465bdc8b - 8fa6f1c6fd8dd76063c08164534b21c87071c7cbb3cc9b1c8378bb62465bdc8b
/opt/CAPEv2/storage/analyses/7659/files/79f568c96db3b96516cc34c3e2868f647de9d7e271982a54142983a44fa78cd5 - 79f568c96db3b96516cc34c3e2868f647de9d7e271982a54142983a44fa78cd5
/opt/CAPEv2/storage/analyses/7659/files/bc37d3dd42d2dcd44fdc90462e3b57cf2c06da1beb02fc69a76353fa423b8954 - bc37d3dd42d2dcd44fdc90462e3b57cf2c06da1beb02fc69a76353fa423b8954
/opt/CAPEv2/storage/analyses/7659/files/bec599549cba9ca49314df4378e280a4c24b43991eaddbee758453674cd815c0 - bec599549cba9ca49314df4378e280a4c24b43991eaddbee758453674cd815c0
/opt/CAPEv2/storage/analyses/7659/files/9915fcfa0cafe062a9c39fcdb700da12519abce5a4b36f404f2264cef024ceb0 - 9915fcfa0cafe062a9c39fcdb700da12519abce5a4b36f404f2264cef024ceb0
/opt/CAPEv2/storage/analyses/7659/files/72bb423af4386cc19726c99ef95a6ebaf671304df92f0dc3e2ab59cdca3d13ce - 72bb423af4386cc19726c99ef95a6ebaf671304df92f0dc3e2ab59cdca3d13ce

Embedded domains

server.com
tsymantec.com
tsecurityresponse.symantec.com
tsarc.com
twww.sarc.com
twww.sophos.com
tsophos.com
twww.mcafee.com
tmcafee.com
tliveupdate.symantecliveupdate.com
twww.viruslist.com
tviruslist.com
tf-secure.com
twww.f-secure.com
tf-prot.com
twww.f-prot.com
tkaspersky.com
tkaspersky-labs.com
twww.avp.com
tavp.com
twww.kaspersky.com
twww.networkassociates.com
tnetworkassociates.com
twww.ca.com
tca.com

Embedded IP addresses

162.159.36.2

Registry keys

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

C:\Program
C:\WINDOWS\system32\drivers\etc\hosts

More Fsysna samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report