MALICIOUS — 0901b477cab1beb5cc72169fe69169b11773f6ab1f5ef28e9b9981b56d940338

MALICIOUS — 0901b477cab1beb5cc72169fe69169b11773f6ab1f5ef28e9b9981b56d940338 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salgorea family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0901b477cab1beb5cc72169fe69169b11773f6ab1f5ef28e9b9981b56d940338
SHA-1: b32a7c9903976b4761141a896f405b677cb74caa
MD5: a42f89f928409156a6cff639584fa802
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 98304:emhd1Urye08ZzHtJuoAFuVLUjH5oxFbxCVLUjH5oxFbx:elU8ZzrWuVUjZEdCVUjZEd
TLSH: T1FA6223E913355B4DF0B0C4481F27619DC82194E916FE2AC2954FB12FB3FE9AB281119B
Submitted as: 0901b477cab1beb5cc72169fe69169b11773f6ab1f5ef28e9b9981b56d940338
File type: pe · Size: 4453888 bytes
Verdict: malicious (100/100) · Family: Salgorea

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.l2
ClamAV (daily): Win.Trojan.Finfish-9787043-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.Agent.GIKJ
Kaspersky (KVRT): Trojan.Win32.Agent.xaktra

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Finfish-9787043-0 (rule Win.Trojan.Finfish-9787043-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.GIKJ (rule Trojan.Agent.GIKJ) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.xaktra (rule Trojan.Win32.Agent.xaktra) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.l2 (rule high-entropy-sections:.l2) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.l2 - static signal, weight 0.25, confidence 0.55
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

185 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\7E91.tmp - 16a17791c1409e7f2d18ae1bf5d97a277c125c7173017981b44bef60c8c6174f
05853fce7188ebcd3b25653e4529d72cb741cca5f28dcf3e56390a4622aa066b - 05853fce7188ebcd3b25653e4529d72cb741cca5f28dcf3e56390a4622aa066b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

b.su
l.sh
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.182.141.63
52.123.252.193
20.42.179.192
4.230.171.124
135.232.92.137
74.179.77.164
4.207.44.65
4.144.132.114
4.207.44.76
52.123.252.222
104.18.33.89
52.168.117.174
20.42.72.131
4.247.188.224
72.145.35.103
52.148.114.188
52.110.12.24
52.110.12.33

File paths

I:\hizh
f:\{
m:\w\C

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report