MALICIOUS — e734f605bd85b1edb97cf77b34e728e53c6478c940f7604f260bfb68c8965b0e
MALICIOUS — e734f605bd85b1edb97cf77b34e728e53c6478c940f7604f260bfb68c8965b0e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Fsysna family. 6 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
e734f605bd85b1edb97cf77b34e728e53c6478c940f7604f260bfb68c8965b0e - SHA-1:
7cfaae8ac307952f30a956ebe83748fdf4c0a104 - MD5:
7da8f4511406df8e370f63263aa16cee - imphash:
b6230692891661869cecd581561a21f4 - ssdeep:
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXB:zW6ncoyqOp6IsTl/mXB - TLSH:
T1644CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112 - Submitted as: e734f605bd85b1edb97cf77b34e728e53c6478c940f7604f260bfb68c8965b0e
- File type: pe · Size: 534752 bytes
- Verdict: malicious (98/100) · Family: Fsysna
Detections (6 of 51 engines)
- ClamAV (daily): Win.Worm.Guap-4
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Trojan:Win32/Fsysna!pz
- Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
- Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Worm.Guap-4 (rule
Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule
Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule
Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded domains
- server.com
- tsymantec.com
- tsecurityresponse.symantec.com
- tsarc.com
- twww.sarc.com
- twww.sophos.com
- tsophos.com
- twww.mcafee.com
- tmcafee.com
- tliveupdate.symantecliveupdate.com
- twww.viruslist.com
- tviruslist.com
- tf-secure.com
- twww.f-secure.com
- tf-prot.com
- twww.f-prot.com
- tkaspersky.com
- tkaspersky-labs.com
- twww.avp.com
- tavp.com
- twww.kaspersky.com
- twww.networkassociates.com
- tnetworkassociates.com
- twww.ca.com
- tca.com
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File paths
- C:\Program
- C:\WINDOWS\system32\drivers\etc\hosts
More Fsysna samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report