MALICIOUS — c9beb32369ce31363a556016ed900a308286b3144648029b9c64b7d365f2755c
MALICIOUS — c9beb32369ce31363a556016ed900a308286b3144648029b9c64b7d365f2755c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
c9beb32369ce31363a556016ed900a308286b3144648029b9c64b7d365f2755c - SHA-1:
3a8eb7b22862caedae49743396d8151e7e0de05e - MD5:
fc1db3847d34c1138144e9d3542c09f8 - imphash:
b6230692891661869cecd581561a21f4 - ssdeep:
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXN:zW6ncoyqOp6IsTl/mXN - TLSH:
T11B4CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112 - Submitted as: c9beb32369ce31363a556016ed900a308286b3144648029b9c64b7d365f2755c
- File type: pe · Size: 534716 bytes
- Verdict: malicious (99/100) · Family: Fsysna
Detections (6 of 52 engines)
- ClamAV (daily): Win.Worm.Guap-4
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Trojan:Win32/Fsysna!pz
- Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
- Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Worm.Guap-4 (rule
Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule
Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule
Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85 - Contacted 31 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
79763 behavior events · 1 ATT&CK techniques · 29 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- msedge.api.cdp.microsoft.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- assets.msn.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- msedge.b.tlu.dl.delivery.mp.microsoft.com
- fe3cr.delivery.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/7605/files/c2e961eacb1287ca4873bad457982bc553bd92c2533cae644971e79ea076c28b -
c2e961eacb1287ca4873bad457982bc553bd92c2533cae644971e79ea076c28b - /opt/CAPEv2/storage/analyses/7605/files/7212cbb201e2b7a51421a1b62feaac90b867da7308b4f4cabae0ef1d410a26e8 -
7212cbb201e2b7a51421a1b62feaac90b867da7308b4f4cabae0ef1d410a26e8 - /opt/CAPEv2/storage/analyses/7605/files/b938dc9ff5c719db4585dd5efb65ae4486316096fda6cba5cff67ca82a1c75c0 -
b938dc9ff5c719db4585dd5efb65ae4486316096fda6cba5cff67ca82a1c75c0 - /opt/CAPEv2/storage/analyses/7605/files/cbe4dc36ba9be24a338f364396a1849d14d827440b5a63e80f310b8a8a150772 -
cbe4dc36ba9be24a338f364396a1849d14d827440b5a63e80f310b8a8a150772 - /opt/CAPEv2/storage/analyses/7605/files/39ff18f3cccfdae36847bbe1981c06205d2e22d3bf39199bafd0f4ef1ae13e64 -
39ff18f3cccfdae36847bbe1981c06205d2e22d3bf39199bafd0f4ef1ae13e64 - /opt/CAPEv2/storage/analyses/7605/files/c320fa40ab4ce726e6dd89aabd83e7ea4a7dbeacf7704bc55a75c5e0367a8e17 -
c320fa40ab4ce726e6dd89aabd83e7ea4a7dbeacf7704bc55a75c5e0367a8e17 - /opt/CAPEv2/storage/analyses/7605/files/09dfe5e0ca787bccf40aa22da0e54068010cf86eb66127732dafbf2852c17778 -
09dfe5e0ca787bccf40aa22da0e54068010cf86eb66127732dafbf2852c17778 - /opt/CAPEv2/storage/analyses/7605/files/2d32e682a33c72264d704e28db7b292611c3ca0a09412b9d70ab2f693d343dac -
2d32e682a33c72264d704e28db7b292611c3ca0a09412b9d70ab2f693d343dac - /opt/CAPEv2/storage/analyses/7605/files/9d4905952beb753b5385d675bb3c54444eb322eae3dd57724a52fdf3d2b2bec0 -
9d4905952beb753b5385d675bb3c54444eb322eae3dd57724a52fdf3d2b2bec0 - /opt/CAPEv2/storage/analyses/7605/files/178f43372c960427eaf45abba1a442d6315d930586da41072ecb1e6d0789ad6d -
178f43372c960427eaf45abba1a442d6315d930586da41072ecb1e6d0789ad6d - /opt/CAPEv2/storage/analyses/7605/files/cd415e2d846539010b789230ccdb08dbd1b3711ea6fac36477922141b100dcb8 -
cd415e2d846539010b789230ccdb08dbd1b3711ea6fac36477922141b100dcb8 - /opt/CAPEv2/storage/analyses/7605/files/e54fa989e41094f1b9243a514b92f95db2a84b0f1a807ca84eeb6cd6fb799736 -
e54fa989e41094f1b9243a514b92f95db2a84b0f1a807ca84eeb6cd6fb799736 - /opt/CAPEv2/storage/analyses/7605/files/dbb7fd3a484aa4ebbe37340fbc5cb30bbbbecc6f1ed1d9d4ef7bb7dd25f624ab -
dbb7fd3a484aa4ebbe37340fbc5cb30bbbbecc6f1ed1d9d4ef7bb7dd25f624ab - /opt/CAPEv2/storage/analyses/7605/files/86377fa2b445ce25a362ae2a731848c0638a1b68b4b3cb9dfcfa9de7c2da4ebb -
86377fa2b445ce25a362ae2a731848c0638a1b68b4b3cb9dfcfa9de7c2da4ebb - /opt/CAPEv2/storage/analyses/7605/files/93399795d1b52b4c72d2bb8fda46d935adbcd66494ed38d5197d130cce8643fc -
93399795d1b52b4c72d2bb8fda46d935adbcd66494ed38d5197d130cce8643fc
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786281809&P2=404&P3=2&P4=KihZ3PUzKJn4b3%2bvlhhPmXugaYqovhLsCl%2b8Lnyyp3uH6ttncfhzpum5TDB6JLNhe9776MeO18pwbuqi7iioYg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786281829&P2=404&P3=2&P4=XCZVlA1skvkvsbJTEZ%2f6mcefRyX%2fiTmQDzeSeq0%2fvyBt1ttAQznR2ilBVHXgve3aZDok1KF7iGunDiZcNRaWrQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- server.com
- tsymantec.com
- tsecurityresponse.symantec.com
- tsarc.com
- twww.sarc.com
- twww.sophos.com
- tsophos.com
- twww.mcafee.com
- tmcafee.com
- tliveupdate.symantecliveupdate.com
- twww.viruslist.com
- tviruslist.com
- tf-secure.com
- twww.f-secure.com
- tf-prot.com
- twww.f-prot.com
- tkaspersky.com
- tkaspersky-labs.com
- twww.avp.com
- tavp.com
- twww.kaspersky.com
- twww.networkassociates.com
- tnetworkassociates.com
- twww.ca.com
- tca.com
Embedded IP addresses
- 172.217.25.174
- 4.207.44.72
- 85.210.196.11
- 4.230.171.124
- 52.253.84.76
- 20.42.179.204
- 52.123.252.242
- 135.232.92.34
- 74.178.240.51
- 74.179.77.204
- 20.42.65.93
- 52.123.252.243
- 203.26.79.13
- 52.123.252.232
- 135.234.160.246
- 52.110.12.14
- 52.110.12.5
- 72.154.7.111
- 52.148.114.188
- 52.110.12.18
- 52.110.12.19
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File paths
- C:\Program
- C:\WINDOWS\system32\drivers\etc\hosts
More Fsysna samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report