MALICIOUS — 1595c08229f63cbfb2c5468ff2740cde8a767acdbc2546de2c30d54fd71d0016

MALICIOUS — 1595c08229f63cbfb2c5468ff2740cde8a767acdbc2546de2c30d54fd71d0016 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 6 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 1595c08229f63cbfb2c5468ff2740cde8a767acdbc2546de2c30d54fd71d0016
SHA-1: c369a96f102e2f66a50a068380402f226dcb6176
MD5: e242a7c9ed5d386f16cd857639dcaec0
imphash: c9b6c3da312e87a7377bab0dcbaf2d4a
ssdeep: 24576:SypW9SgLNZaOdcTMuUvxIgZBLeWSKf9+mWEszWTvi2WP8j:St9SgLNZa6xIqs29IzQqkj
TLSH: T12E543377617405CBC3D3DF548E0F060E94713C72A83EEF5E21E2716888A5A0BBB948A5
Submitted as: 1595c08229f63cbfb2c5468ff2740cde8a767acdbc2546de2c30d54fd71d0016
File type: pe · Size: 1108132 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
ClamAV (daily): Win.Malware.Zusy-9781883-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Salgorea.VRR!MTB
Kaspersky (KVRT): Backdoor.Win32.Salgorea.id

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9781883-0 (rule Win.Malware.Zusy-9781883-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:, Microsoft Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

162 behavior events · 1 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\FB48.tmp - 5c8d614540e1a413056228d87152f1a1108790bd9bf1d30229d971b98ad3bf41
cdab9660cf25db7302b108a6c280b4af5d8f8d9271b48d554c3e76f34b7a51f2 - cdab9660cf25db7302b108a6c280b4af5d8f8d9271b48d554c3e76f34b7a51f2
2dc34b5afae2c53dcdd872b44e63155c9b47c9eac4adfb4f59911475ff06dac7 - 2dc34b5afae2c53dcdd872b44e63155c9b47c9eac4adfb4f59911475ff06dac7
6d5688e8c2bc105ab282adf14dda5805c892867d9424bff40902386d98d8e0e2 - 6d5688e8c2bc105ab282adf14dda5805c892867d9424bff40902386d98d8e0e2
a27e97f17376d369196c22bfe5f7c9faf662e0264edc608416c748d479f4d29a - a27e97f17376d369196c22bfe5f7c9faf662e0264edc608416c748d479f4d29a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787790949&P2=404&P3=2&P4=NtrrLztgK0ttUKvrqUFfFuy5La0vAJqJqKz2KG1HQLvPFv1aPDvx%2brK8Vw2HehEMUUpnbxIIhQhTAJJ5uLGgXA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787790963&P2=404&P3=2&P4=Oi82iUlnJChG6a0DlfodAbm1eoyoPiPcKuxrnfD7Ec3fiTP0BxiOoYgD2nR1wePKpTu9P7y8nUzEEtjWKdNx%2bQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

e8.sh
schemas.microsoft.com

Embedded IP addresses

13.69.116.104
52.123.252.243
40.84.97.4
4.230.171.124
52.230.59.222
52.123.252.230
74.179.71.159
20.165.94.63
20.184.175.7
74.178.76.54
52.123.252.226
203.26.79.13
4.207.44.65
20.76.201.171
52.123.128.14
52.123.129.14
40.103.64.226
135.234.160.244
52.148.114.188
72.153.5.137
52.110.12.52
52.110.12.26

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report