MALICIOUS — 1959d65d48d088fc5e19fd5351c67989adc5e8690ed0816ad1c43ae5ab1e22e2

MALICIOUS — 1959d65d48d088fc5e19fd5351c67989adc5e8690ed0816ad1c43ae5ab1e22e2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salgorea family. 4 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1959d65d48d088fc5e19fd5351c67989adc5e8690ed0816ad1c43ae5ab1e22e2
SHA-1: 8e94f71b3852acd639f6096dfa4f8d4287caac9a
MD5: 641bc242a19cd95805576fe6c1cd1257
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d1qeWLy0/VFuMZj2ul9tj1+On:Qoa1taC0yqeWLy+VoglV
TLSH: T17A5A23499A195B0DE3F6C4846D2912ADD442E8E7937C298B02CFF15E63CB97378210DB
Submitted as: 1959d65d48d088fc5e19fd5351c67989adc5e8690ed0816ad1c43ae5ab1e22e2
File type: pe · Size: 1958408 bytes
Verdict: malicious (100/100) · Family: Salgorea

Detections (4 of 51 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): c40eabd27d1abda0252eb6d5134ee955df7434d2a2585d5848bcffc2c469b1e5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 51 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

99 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/27538/files/c40eabd27d1abda0252eb6d5134ee955df7434d2a2585d5848bcffc2c469b1e5 - c40eabd27d1abda0252eb6d5134ee955df7434d2a2585d5848bcffc2c469b1e5
72a953fed971b9cbdd7728bd105ce60884fb88c01d4fe3311d6d763cbf228392 - 72a953fed971b9cbdd7728bd105ce60884fb88c01d4fe3311d6d763cbf228392

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786994904&P2=404&P3=2&P4=DXiMWcLFrYZsw4nyGFuEKNusJkRXoULmVUkcHQK2gQ31jI%2fGobZl8JDiscFI7Rc8hppyGpPhni2tbyUprBaV%2fA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

40.84.97.4
52.168.112.67
57.154.63.210
4.144.132.223
4.230.171.124
20.165.94.63
4.150.223.96
20.76.201.171
20.236.44.162
135.233.45.223
20.50.201.205
135.233.95.135
20.42.65.94
74.178.240.61
135.232.92.97
162.159.36.2
52.148.114.188
85.210.193.152
92.223.78.30
74.179.77.204
203.26.79.13
52.123.129.14
51.11.192.51
74.178.232.29
52.110.12.10

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report