MALICIOUS — ff5c6b79479af701edd082a423457a17f7bee6d7a5c8129da9a1afcd42357a6f
MALICIOUS — ff5c6b79479af701edd082a423457a17f7bee6d7a5c8129da9a1afcd42357a6f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fsysna family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
ff5c6b79479af701edd082a423457a17f7bee6d7a5c8129da9a1afcd42357a6f - SHA-1:
7bad349b5a368409ffb8de7405cef34fb5319612 - MD5:
161685688a0d0dd09458dc88aa39de74 - imphash:
b6230692891661869cecd581561a21f4 - ssdeep:
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXv:zW6ncoyqOp6IsTl/mXv - TLSH:
T1CE4CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112 - Submitted as: ff5c6b79479af701edd082a423457a17f7bee6d7a5c8129da9a1afcd42357a6f
- File type: pe · Size: 534764 bytes
- Verdict: malicious (100/100) · Family: Fsysna
Detections (6 of 52 engines)
- ClamAV (daily): Win.Worm.Guap-4
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Trojan:Win32/Fsysna!pz
- Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
- Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Worm.Guap-4 (rule
Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Fsysna!pz (rule
Trojan:Win32/Fsysna!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Spesr.VB.1 (rule
Gen:Heur.Spesr.VB.1) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- Extracted BlackShades config (0 C2) - engine signal, weight 0.45, confidence 0.60
- YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (windows)
73879 behavior events · 2 ATT&CK techniques · 27 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- inference.location.live.net
- desktop-hsgcbep
- login.live.com
- ctldl.windowsupdate.com
- config.edge.skype.com
- www.bing.com
- v20.events.data.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- settings-win.data.microsoft.com
- tas02.sls.update.microsoft.com
- dns.msftncsi.com
- fe3cr.delivery.mp.microsoft.com
- msedge.api.cdp.microsoft.com
- edge.microsoft.com
- aefd.nelreports.net
- assets.msn.com
- www.msftncsi.com
Dropped files
- /opt/CAPEv2/storage/analyses/7643/files/709b428bad5434e16d062f0363beb5c8132b5c6098bdbdf1ae5e46f9b49ee026 -
709b428bad5434e16d062f0363beb5c8132b5c6098bdbdf1ae5e46f9b49ee026 - /opt/CAPEv2/storage/analyses/7643/files/d6b51bdbada02c29baf5d82d94a4f511f081f0fb62db35b49ec546de5b8ccc47 -
d6b51bdbada02c29baf5d82d94a4f511f081f0fb62db35b49ec546de5b8ccc47 - /opt/CAPEv2/storage/analyses/7643/files/17dd489d53e7da18d01646def08a2149197385318f84a367fa862549c746f5a7 -
17dd489d53e7da18d01646def08a2149197385318f84a367fa862549c746f5a7 - /opt/CAPEv2/storage/analyses/7643/files/4d844a193020b1f415a7259f5330161f19f3026b6aa2177d66672b27b470d606 -
4d844a193020b1f415a7259f5330161f19f3026b6aa2177d66672b27b470d606 - /opt/CAPEv2/storage/analyses/7643/files/5866360b70fff55a9d287eda3fc436c59177494897080171fa643d8b503980a1 -
5866360b70fff55a9d287eda3fc436c59177494897080171fa643d8b503980a1 - /opt/CAPEv2/storage/analyses/7643/files/be7b1eeda3aeac8ebdfa0b9689bd8bda6afa4f87388f02ada054d034d883d736 -
be7b1eeda3aeac8ebdfa0b9689bd8bda6afa4f87388f02ada054d034d883d736 - /opt/CAPEv2/storage/analyses/7643/files/f5e9112bfea7b068aa60f3e1aa81b8d9b26b5c379b87082be78ceb0e107b514f -
f5e9112bfea7b068aa60f3e1aa81b8d9b26b5c379b87082be78ceb0e107b514f - /opt/CAPEv2/storage/analyses/7643/files/13e7c4b76fd6d8fb419aa6b809d499c3e6732fd12154ac4758fca69aadc1f7f3 -
13e7c4b76fd6d8fb419aa6b809d499c3e6732fd12154ac4758fca69aadc1f7f3 - /opt/CAPEv2/storage/analyses/7643/files/5a2c8c3b6ca1a9a963a9d7735d1031afd9f4e0f80873f81a9dbf23be4761a48e -
5a2c8c3b6ca1a9a963a9d7735d1031afd9f4e0f80873f81a9dbf23be4761a48e - /opt/CAPEv2/storage/analyses/7643/files/120d72e61d9f3886465b084e689fc23827be802bfa3353ef273be2812334f228 -
120d72e61d9f3886465b084e689fc23827be802bfa3353ef273be2812334f228 - /opt/CAPEv2/storage/analyses/7643/files/b43f3d725ece9cdd56eeafaa5afb315c35d741bc76084670ddbed2c56b908a80 -
b43f3d725ece9cdd56eeafaa5afb315c35d741bc76084670ddbed2c56b908a80 - /opt/CAPEv2/storage/analyses/7643/files/bcada53d72b81c9b8c8289f8d1a2c52f9a24c771138e34359bf4fab462bae8a9 -
bcada53d72b81c9b8c8289f8d1a2c52f9a24c771138e34359bf4fab462bae8a9 - /opt/CAPEv2/storage/analyses/7643/files/bb07cf5fa767445d3bf8bb104d80429312fba1e27fb3b5f3b92886e8a5df45fa -
bb07cf5fa767445d3bf8bb104d80429312fba1e27fb3b5f3b92886e8a5df45fa - /opt/CAPEv2/storage/analyses/7643/files/743345bcfcae5848e6e635c9cd1c28a25b1b580a05a6267c2edee5d23753f95f -
743345bcfcae5848e6e635c9cd1c28a25b1b580a05a6267c2edee5d23753f95f - /opt/CAPEv2/storage/analyses/7643/files/84131f5ff9957b82c65b8c47b047b0f144978eafa51e6514ef75c858b1ff0a87 -
84131f5ff9957b82c65b8c47b047b0f144978eafa51e6514ef75c858b1ff0a87
Embedded domains
- server.com
- tsymantec.com
- tsecurityresponse.symantec.com
- tsarc.com
- twww.sarc.com
- twww.sophos.com
- tsophos.com
- twww.mcafee.com
- tmcafee.com
- tliveupdate.symantecliveupdate.com
- twww.viruslist.com
- tviruslist.com
- tf-secure.com
- twww.f-secure.com
- tf-prot.com
- twww.f-prot.com
- tkaspersky.com
- tkaspersky-labs.com
- twww.avp.com
- tavp.com
- twww.kaspersky.com
- twww.networkassociates.com
- tnetworkassociates.com
- twww.ca.com
- tca.com
Embedded IP addresses
- 162.159.36.2
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File paths
- C:\Program
- C:\WINDOWS\system32\drivers\etc\hosts
More Fsysna samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report