MALICIOUS — 00dfce21ff2ba83dbd0ce584b5905ab3ae811f0766dc4d55e813efefd1070995

MALICIOUS — 00dfce21ff2ba83dbd0ce584b5905ab3ae811f0766dc4d55e813efefd1070995 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 00dfce21ff2ba83dbd0ce584b5905ab3ae811f0766dc4d55e813efefd1070995
SHA-1: 3a7fe0ad861bfae0044e3249cf6f3cc97bb65651
MD5: 98c584210b0d3fd7e7f580ee6b70e56f
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dEEC85h8Lxs3DZsqprY978KOowgOFGLVP:Qoa1taC02h8UeqprYl7Vw/Gt
TLSH: T1245A2346260A360DE7F5C1C46C29526EC082A8F757BC19CB428FF09EB3DB567781129B
Submitted as: 00dfce21ff2ba83dbd0ce584b5905ab3ae811f0766dc4d55e813efefd1070995
File type: pe · Size: 1958408 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\413A.tmp - d95ab1cce99c8a95e22739d04f49d9e4e0cd269db4a632ca4db7689a355a249c
f1b5b355f2e730ba3489743d505529a538b6f4ba82fee5e0a7408f6aae83afe5 - f1b5b355f2e730ba3489743d505529a538b6f4ba82fee5e0a7408f6aae83afe5

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787789776&P2=404&P3=2&P4=EeWqj6Uj3%2bb%2bPKUoW8O8uESy9O7wQ5Qw5BFr7a5k0ZnbTe7DK4GH31J0QMxXkRXtRVe2kTh4cGYwScyET838Ig%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787789800&P2=404&P3=2&P4=IWDUA52OUuw%2f1I6TagcPl4gMLdS158Wb%2bfmWzS6%2bQQsydL9N0uU1I%2fKGVed4pOpbgMcTjqkf9GF3XKS6iQ8aYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.90
52.123.252.241
40.84.97.4
20.247.184.142
4.230.171.124
57.155.104.224
135.233.95.144
20.184.175.23
20.112.250.133
52.123.129.14
74.179.77.164
20.42.65.89
52.123.252.247
172.178.240.161
203.26.79.13
52.123.252.216
74.178.232.29
92.223.78.30
52.148.114.188
72.153.5.131
52.110.12.16
52.110.12.15

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report